Trufusion Enterprise
Vendor:
First CVE: Jan 12, 2023 · Active for 3 years
8
Total CVEs
More Total CVEs than 87% of tracked products
2.7
Avg CVEs / Year
Higher CVE frequency than 78% of tracked products
8.2
Avg CVSS
Higher Avg CVSS than 74% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Trufusion Enterprise over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 12, 2023
3 years ago
Most Recent CVE
Feb 17, 2026
160 days ago
CVE Severity & Scoring
Trufusion Enterprise8 CVEs
75%
25%
All CVEs352,785 CVEs
45%
40%
11%
HighCritical
Attack Vector
Local0 (0.0%)
Network8 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low8 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None8 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low1 (12.5%)
High0 (0.0%)
None7 (87.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-27225HIGH TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive interna | Oct 27, 2025 | 7.5 | 49 | NO | YES |
CVE-2025-27222HIGH TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this e | Oct 27, 2025 | 8.6 | 42 | NO | YES |
CVE-2025-27223HIGH TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the applica | Oct 27, 2025 | 7.5 | 41 | NO | YES |
CVE-2025-32355HIGH Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is misconfigured in a way that allows specifying absolute URLs | Feb 17, 2026 | 7.3 | 37 | NO | YES |
CVE-2022-25026HIGH A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network via a crafted HTTP re | Jan 12, 2023 | 7.5 | 37 | NO | NO |
CVE-2025-59793CRITICAL Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the applicati | Feb 17, 2026 | 9.9 | 32 | NO | NO |
CVE-2025-27224CRITICAL TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the input to this endpoint, | Oct 27, 2025 | 9.8 | 29 | NO | NO |
CVE-2022-25027HIGH The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's sessi | Jan 12, 2023 | 7.5 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
4 CVEs
50.0% of CVEs· 98th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Trufusion Enterprise
Top CWEs
Versions
No cataloged versions.