PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-15581] Orthanc 1.12.9 User Impersonation

projectblack.io | research | CVE-2025-15581 | #appsec | #vulnerability-research | #vulnerability | #healthcare | #impersonation | #orthanc | #dicom | #cve-2025-15581
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

User impersonation in Orthanc DICOM server (CVE-2025-15581): its auth filter takes everything before the first colon as the username, so a crafted username impersonates others. Fixed in 1.12.10.
CVE
CVE-2025-15581
Published
Collected

Related coverage

research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
research · slcyber.io
How practical is 100k requests per second? Introducing h3fuzz
Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back