CVE-2025-24690
CVSS 3.1 Score 8.1 of 10 (high)
Details
Published Mar 26, 2025
Updated: Mar 27, 2025
CWE ID 98
Summary
CVE-2025-24690 is a filename manipulation vulnerability affecting Michele Giorgi Formality, from an unknown version up to 1.5.7. An attacker can exploit this issue, classified as a PHP Remote File Inclusion (RFI), by manipulating the filename in an include or require statement. Successful exploitation could result in the attacker gaining unauthorized access to the targeted system or executing arbitrary code. As a precaution, users are strongly advised to update their Formality installation as soon as possible to the latest version.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.