CVE-2025-13845

HighCVSS 7.8/10Last modified Sep 3, 2026

Description

CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
Schneider ElectricEcoStruxure Power Build RapsodyFR v2.8.1.0300 and prior; ESP v2.8.5.0200 and prior; PT v2.8.7.0100 and prior; BEL (FR) v2.8.8.0100 and prior; BEL (EN) v2.8.3.0100 and prior; INT (EN) v2.8.4.0300 and prior; NL v2.8.2.0000 and prior

References

Timeline

Published
Jan 15, 2026
Last modified
Sep 3, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-138466.4The Easy Map Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and CVE-2025-138476.4The PhotoFade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'time' parameter in all versions up to, and includinCVE-2025-138486.4The STM Gallery 1.9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'composicion' parameter in all versions up to,CVE-2025-138496.4The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and CVE-2025-13857.5When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server toCVE-2025-138506.4The LS Google Map Router plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'map_type' parameter in all versions up tCVE-2025-138519.8The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all veCVE-2025-138526.4The Debt.com Business in a Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'configuration' parameter of the leCVE-2025-138536.4The Nearby Now Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_tech' parameter of the nn-tech shortcCVE-2025-138546.4The Curved Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'radius' parameter of the arctext shortcode in allCVE-2025-138558.8IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafCVE-2025-138566.4The Extra Post Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the extra-images shortcode
CVE-2025-13845: High severity, CVSS 7.8 | Vulnix