CVE-2025-6811
BaseFortify
Publication date: 2025-07-07
Last updated on: 2025-08-14
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mescius | activereports.net | 18.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a critical remote code execution flaw in the Mescius ActiveReports.NET software, specifically in the TypeResolutionService class. It occurs because the software does not properly validate user-supplied data, leading to deserialization of untrusted data. This allows a remote attacker to execute arbitrary code within the context of the current process. Exploitation requires interaction with the ActiveReports.NET library, but the exact attack methods may vary depending on how the software is implemented. [1]
How can this vulnerability impact me? :
Exploiting this vulnerability can allow remote attackers to execute arbitrary code on affected systems without needing any privileges or user interaction. This can compromise the confidentiality, integrity, and availability of the system, potentially leading to full system compromise or disruption of services. [1]