PatchTheCVEchangeweb vulnerabilities
Recent CVEs affecting changeweb products. 7 tracked.
changeweb has 7 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-03-17. Highest priority: CVE-2024-53573 (score 56/100).
- CVE-2025-25621 MEDIUM 4.3 DOWNGRADE Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fe
- CVE-2025-25620 MEDIUM 5.4 DOWNGRADE Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.
- CVE-2025-25618 LOW 3.3 DOWNGRADE Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section
- CVE-2025-25616 MEDIUM 4.3 DOWNGRADE Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exam
- CVE-2025-25615 LOW 2.7 DOWNGRADE Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all cl
- CVE-2025-25614 HIGH 8.8 DOWNGRADE Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to updat
- CVE-2024-53573 CRITICAL 9.8 DOWNGRADE Unifiedtransform v2.X is vulnerable to Incorrect Access Control
FAQ
How do I fix changeweb vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is changeweb being exploited right now?
None of the tracked changeweb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which changeweb CVE should I patch first?
CVE-2024-53573 currently ranks highest (56/100): Unifiedtransform v2.X is vulnerable to Incorrect Access Control.