Medium severity · published Jan 28, 2026
CVE-2025-41351
Weak encryption on Funambol's cloud server
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
Vulnerability that allows a Padding Oracle Attack to be performed on the Funambol v30.0.0.20 cloud server. The thumbnail display URL allows an attacker to decrypt and encrypt the parameters used by the application to generate ‘self-signed’ access URLs.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cloud Server · Funambol
30.0.0.20 · source: vendor