Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-60949— Census CSWeb leaked configuration files

CVSS 9.1 · Critical EPSS 0.05% · P14
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-60949

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Census CSWeb leaked configuration files
Source: NVD (National Vulnerability Database)
Vulnerability Description
Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
CSPro Users CSWeb 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CSPro Users CSWeb是美国CSPro Users公司的一个 Web 应用程序，允许用户在客户端设备和 Web 服务器之间安全地传输案例或文件。 CSPro Users CSWeb 8.0.1版本存在安全漏洞，该漏洞源于在某些部署中app/config可通过HTTP访问，可能导致未经身份验证的远程攻击者发送请求访问配置文件并获取泄露的密钥。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

VendorProductAffected VersionsCPESubscribe
CensusCSWeb 8.0.1 ~ 8.1.0 alpha -

II. Public POCs for CVE-2025-60949

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-60949

请登录查看更多情报信息。

Same Patch Batch · Census · 2026-03-23 · 4 CVEs total

CVE-2025-609468.8 HIGHCensus CSWeb path traversal
CVE-2025-609478.8 HIGHCensus CSWeb arbitrary file upload
CVE-2025-609484.6 MEDIUMCensus CSWeb stored XSS

IV. Related Vulnerabilities

Same product: CSWeb
Same vendor: Census
Same weakness: CWE-200

V. Comments for CVE-2025-60949

No comments yet

Leave a comment