CVE-2025-22478

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: May 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-224794.3Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('CVE-2025-22485.4The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to CVE-2025-224807.8Dell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with local CVE-2025-224818.8A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could CVE-2025-224828.1A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could CVE-2025-224834.8A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an CVE-2025-224847.1An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gain CVE-2025-224868.8An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow rem CVE-2025-22498.8The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_CVE-2025-224907.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can th CVE-2025-224916.7The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead in CVE-2025-224926.3The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for