Live › vulnerability › CVE-2025-68391
The PROTECTELMAJ and BDF modules of ARKETEAM Protectel let any user upload arbitrary files and overwrite existing files in a temporary folder. An attacker can plant embedded JavaScript that runs when an authenticated user downloads the uploaded file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Organisations running ARKETEAM Protectel PROTECTELMAJ or BDF modules before the fixed versions are exposed. Systems without these modules installed can skip it. unknown whether the sources describe a default-config or auth-only path beyond the stated download-triggered execution.
No product ranges from the sources yet.
6.5.19 and the BDF version against 6.4.676.5.19 or later6.4.67 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
This page as .md · .json · in your agent: get_signal("CVE-2025-68391")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.