CVE-2025-14518

CriticalCVSS 9.8/10Last modified Oct 14, 2026

Description

A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argument targetIp/targetPort leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
n/a	PowerJob	5.1.0; 5.1.1; 5.1.2

References

https://github.com/PowerJob/PowerJob/
https://github.com/PowerJob/PowerJob/issues/1144Exploit, Issue Tracking
https://github.com/PowerJob/PowerJob/issues/1144#issue-3673393002Exploit, Issue Tracking
https://vuldb.com/?ctiid.335856Permissions Required, VDB Entry
https://vuldb.com/?id.335856Third Party Advisory, VDB Entry
https://vuldb.com/?submit.702896Third Party Advisory, VDB Entry
https://github.com/PowerJob/PowerJob/issues/1144Exploit, Issue Tracking
https://github.com/PowerJob/PowerJob/issues/1144#issue-3673393002Exploit, Issue Tracking

Timeline

Published: Dec 11, 2025
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-145195.4A security flaw has been discovered in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. This issue affects some unknown processin CVE-2025-14523.5The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such a CVE-2025-145209.1A weakness has been identified in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. Impacted is an unknown function of the file /a CVE-2025-145217.5A security vulnerability has been detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The affected element is an unknown CVE-2025-145229.8A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The impacted element is an unknown function of t CVE-2025-145238.2A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processi CVE-2025-145245.3When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses CVE-2025-145256.4A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to r CVE-2025-145268.8A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a mani CVE-2025-145279.8A weakness has been identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file CVE-2025-145287.5A vulnerability was detected in D-Link DIR-803 up to 1.04. Impacted is an unknown function of the file /getcfg.php of the component Configur CVE-2025-145299.8A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The affected element is an unknown function of the file /admin/a