CVE-2025-14848

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-36

Affected software

VendorProductVersions
AdvantechWebAccess/SCADA9.2.1

References

Timeline

Published
Dec 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-148499.8Advantech WebAccess/SCADA  is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.CVE-2025-14854.8The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 dCVE-2025-148509.1Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files.CVE-2025-148516.4The YaMaps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `yamap` shortcode parameters in all versiCVE-2025-148524.3The MDirector Newsletter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.8. This CVE-2025-148534.3The LEAV Last Email Address Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions <= 1.7.1. This is due to CVE-2025-148545.4The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipienCVE-2025-148557.2The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form field parameters in all versions up to, and incCVE-2025-148568.8A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/CVE-2025-148575.4An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory wriCVE-2025-148585.1The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability in its firmware valCVE-2025-148597.0The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the imp
CVE-2025-14848: Medium severity, CVSS 5.3 | Vulnix