CVE-2025-14988

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confidentiality, integrity, or availability of the system.

Metrics

CVSS 4.0 10.0/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jan 27, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-149899.8A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This issue affects some unknown processing CVE-2025-14996.5IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could beCVE-2025-149909.8A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of theCVE-2025-149914.8A weakness has been identified in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown functionCVE-2025-149928.8A security vulnerability has been detected in Tenda AC18 15.03.05.05. The impacted element is the function strcpy of the file /goform/GetParCVE-2025-149938.8A vulnerability was detected in Tenda AC18 15.03.05.05. This affects the function sprintf of the file /goform/SetDlnaCfg of the component HTCVE-2025-149948.8A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155). This impacts the function strcat of the file /goform/webtypeliCVE-2025-149958.8A vulnerability has been found in Tenda FH1201 1.2.0.14(408). Affected is the function sprintf of the file /goform/SetIpBind. Such manipulatCVE-2025-149969.8The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all veCVE-2025-149978.8The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validCVE-2025-149989.8The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. ThiCVE-2025-149994.3The Latest Tabs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to m
CVE-2025-14988: Critical severity, CVSS 10.0 | Vulnix