Manager-Io Manager vulnerabilities

CVE-2025-64180 [CRITICAL] CWE-367 CVE-2025-64180: Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and b Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The flaw lies in the fundamental design of the DNS validation mechanism. A Time-of-Check Time-of-Use (TOCTOU) condition that allows attackers to bypass network

CVE-2025-54122 [CRITICAL] CWE-918 CVE-2025-54122: Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an unauthenticated attacker to bypass network isolation an