https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-48931.htmlhttps://patchthecve.com/cve/CVE-2025-48931.htmlWed, 17 Jun 2026 09:30:30 +0000LOW 3.2: The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities (including rainbow tables) with low computational effort.https://patchthecve.com/cve/CVE-2025-48930.htmlhttps://patchthecve.com/cve/CVE-2025-48930.htmlWed, 17 Jun 2026 09:30:30 +0000LOW 2.8: The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to an adversary through various avenues.https://patchthecve.com/cve/CVE-2025-48929.htmlhttps://patchthecve.com/cve/CVE-2025-48929.htmlWed, 17 Jun 2026 09:30:30 +0000MEDIUM 4.0: The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary.https://patchthecve.com/cve/CVE-2025-48928.htmlhttps://patchthecve.com/cve/CVE-2025-48928.htmlWed, 17 Jun 2026 09:30:30 +0000MEDIUM 4.0: The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.https://patchthecve.com/cve/CVE-2025-48927.htmlhttps://patchthecve.com/cve/CVE-2025-48927.htmlWed, 17 Jun 2026 09:30:29 +0000MEDIUM 5.3: The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.https://patchthecve.com/cve/CVE-2025-48926.htmlhttps://patchthecve.com/cve/CVE-2025-48926.htmlWed, 17 Jun 2026 09:30:29 +0000MEDIUM 4.3: The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers.https://patchthecve.com/cve/CVE-2025-48925.htmlhttps://patchthecve.com/cve/CVE-2025-48925.htmlWed, 17 Jun 2026 09:30:29 +0000MEDIUM 4.3: The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential.https://patchthecve.com/cve/CVE-2025-47730.htmlhttps://patchthecve.com/cve/CVE-2025-47730.htmlWed, 17 Jun 2026 09:28:37 +0000MEDIUM 4.8: The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the credentials of logfile for the user and enRR8UVVywXYbFkqU#QDPRkO for the password.