NVD disclosure day

Published threat advisories for October 17, 2025

CVE-2025-56218

SigningHub Arbitrary File Upload Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

An arbitrary file upload vulnerability in SigningHub enables attackers to execute arbitrary code by uploading a crafted PDF. This could lead to system compromise if the affected technology is reachable.

NVD published: October 17, 2025

CVE advisoryCRITICAL

CVE-2025-57567

PluXml CMS Theme Editor Remote Code Execution Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A vulnerability in the PluXml CMS theme editor allows an authenticated administrator to overwrite a PHP file with arbitrary code, enabling system command execution. This could impact the integrity and availability of the CMS and its server environment. The primary concern is confirming the relevance and exposure of Plu

NVD published: October 17, 2025