Savy Surumpudi

4 exploits Active since Mar 2026
CVE-2025-60946 WRITEUP HIGH WRITEUP
Census CSWeb 8.0.1 - Path Traversal
Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file directories. Fixed in 8.1.0 alpha.
CVSS 8.8
CVE-2025-60947 WRITEUP HIGH WRITEUP
Census CSWeb 8.0.1 - Arbitrary File Upload
Census CSWeb 8.0.1 allows arbitrary file upload. A remote, authenticated attacker could upload a malicious file, possibly leading to remote code execution. Fixed in 8.1.0 alpha.
CVSS 8.8
CVE-2025-60948 WRITEUP MEDIUM WRITEUP
Census CSWeb 8.0.1 - Authenticated Stored Cross-Site Scripting in User Supplied Fields
Census CSWeb 8.0.1 allows stored cross-site scripting in user supplied fields. A remote, authenticated attacker could store malicious javascript that executes in a victim's browser. Fixed in 8.1.0 alpha.
CVSS 4.6
CVE-2025-60949 WRITEUP CRITICAL WRITEUP
Census CSWeb 8.0.1 - Info Disclosure
Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.
CVSS 9.1