Ascertia Signinghub vulnerabilities

CVE-2025-56218 [CRITICAL] CWE-434 CVE-2025-56218: An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary co An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.

CVE-2025-54321 [CRITICAL] CWE-799 CVE-2025-54321: In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password functio In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests.

CVE-2025-56221 [CRITICAL] CWE-307 CVE-2025-56221: A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authe A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.

CVE-2025-56224 [HIGH] CWE-307 CVE-2025-56224: A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 al A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack.

CVE-2025-56223 [HIGH] CWE-770 CVE-2025-56223: A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows atta A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Denial of Service (DoS) via uploading an excessive number of files.

CVE-2025-56219 [HIGH] CWE-284 CVE-2025-56219: Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts with Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiting. This can lead to a resource exhaustion and a Denial of Service (DoS) when an excessively large number of user accounts are created.

CVE-2025-54320 [MEDIUM] CWE-770 CVE-2025-54320: In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests.

CVE-2025-61166 [MEDIUM] CWE-601 CVE-2025-61166: An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL.