Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via "path" parameter in the downloadAttachment and downloadAttachmentFromPath API calls.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2025-66955 Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via "path" p… https://www.cve.org/CVERecord?id=CVE-2025-66955
Post summary
A brief disclosure of CVE‑2025‑66955 reports a local file inclusion flaw in Asseco SEE Live 2.0 for authenticated users, but provides no PoC, exploit, active use, or patch information.
CVE-2025-66955 Local File Inclusion in Asseco SEE Live 2.0 via Authenticated API Calls https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-66955
Post summary
The post announces a local file inclusion vulnerability (CVE‑2025‑66955) in Asseco SEE Live 2.0 that can be triggered through authenticated API calls, with a link to further details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | asseco | live | 2.0 | - | - |