CVE-2025-0619

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

VendorProductVersions
M-Files CorporationM-Files Server< 25.1.14445.5

References

Timeline

Published
Jan 23, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-06204.9A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. CVE-2025-06226.4A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. ThiCVE-2025-06247.6A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user cCVE-2025-06253.1A vulnerability, which was classified as problematic, was found in CampCodes School Management Software 1.0. This affects an unknown part ofCVE-2025-06267.5The "monitor" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing deviCVE-2025-06273.5The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings,CVE-2025-06288.1An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_vieweCVE-2025-06294.8The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could alloCVE-2025-06306.5Multiple Western Telematic (WTI) products contain a web interface that is vulnerable to a local file inclusion attack (LFI), where any autheCVE-2025-06318.7A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in cCVE-2025-06329.2Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitiCVE-2025-06335.1Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacker to read out of bound memory
CVE-2025-0619: Medium severity, CVSS 4.9 | Vulnix