CVE-2025-14018

HighCVSS 7.3/10Last modified Oct 14, 2026

Description

Unquoted Search Path or Element vulnerability in NetBT Consulting Services Inc. E-Fatura allows Leveraging/Manipulating Configuration File Search Paths, Redirect Access to Libraries.

This issue affects e-Fatura: before 1.2.15.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published: Dec 22, 2025
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-140194.7LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure CVE-2025-14025.3The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the CVE-2025-140204.3LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security To CVE-2025-140214.3The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to exec CVE-2025-140226.8LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial CVE-2025-140234.3LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user inte CVE-2025-140258.5A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gate CVE-2025-140267.8Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use CVE-2025-140278.7Multiple denial-of-service vulnerabilities exist in the affected product. These issues can be triggered through various crafted inputs, incl CVE-2025-140284.4The Contact Us Simple Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and i CVE-2025-140295.3The Community Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_a CVE-2025-14038.6Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a