Impronta Janto vulnerabilities

CVE-2025-1107 [CRITICAL] CWE-620 CVE-2025-1107: Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauth Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint ‘/public/cgi/Gateway.php’.

CVE-2025-1108 [HIGH] CWE-345 CVE-2025-1108: Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allo Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the vulnerability, the attacker must create a POST request by injecting malicious content into the ‘Xml’ parameter on the ‘/public/cgi/Gateway.php’ endpo