# cve.now: TeleMessage

The newest entries naming TeleMessage as an affected vendor (up to 200), of 9 in all, 3 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-48931](https://cve.now/CVE-2025-48931.md): The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities (including rainbo (CVSS 3.2)
- [CVE-2025-48930](https://cve.now/CVE-2025-48930.md): The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to a (CVSS 2.8)
- [CVE-2025-48929](https://cve.now/CVE-2025-48929.md): The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expirat (CVSS 4.0)
- [CVE-2025-48928](https://cve.now/CVE-2025-48928.md): The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in (CVSS 4.0, KEV)
- [CVE-2025-48927](https://cve.now/CVE-2025-48927.md): The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploit (CVSS 5.3, KEV)
- [CVE-2025-48926](https://cve.now/CVE-2025-48926.md): The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telep (CVSS 4.3)
- [CVE-2025-48925](https://cve.now/CVE-2025-48925.md): The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as (CVSS 4.3)
- [CVE-2025-47730](https://cve.now/CVE-2025-47730.md): The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Si (CVSS 4.8)
- [CVE-2025-47729](https://cve.now/CVE-2025-47729.md): The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which i (CVSS 1.9, KEV)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/telemessage
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.