CVE-2025-22479

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: May 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-22485.4The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to CVE-2025-224807.8Dell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with local CVE-2025-224818.8A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could CVE-2025-224828.1A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could CVE-2025-224834.8A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an CVE-2025-224847.1An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gain CVE-2025-224868.8An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow rem CVE-2025-22498.8The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_CVE-2025-224907.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can th CVE-2025-224916.7The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead in CVE-2025-224926.3The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for CVE-2025-224935.6Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the se