CVE-2025-24937

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on.

The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. The web application allows arbitrary files to be included in a file that was downloadable and executable by the web server.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

Vendor	Product	Versions
Nokia	WaveSuite NOC	WS-NOC 24.6, WS-NOC 23.6 and WS-NOC 23.12

References

https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24937/Vendor Advisory

Timeline

Published: Jul 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-249388.4The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high pri CVE-2025-24949.8Unrestricted file upload to Softdial Contact Center of Sytel Ltd. This vulnerability could allow an attacker to upload files to the server v CVE-2025-249465.3The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a conside CVE-2025-249475.3A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote atta CVE-2025-249486.5In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records.CVE-2025-249496.5In JotUrl 2.0, is possible to bypass security requirements during the password change process.CVE-2025-24955.4Stored Cross-Site Scripting (XSS) in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to upload XML files to the CVE-2025-249569.8A vulnerability has been identified in OpenV2G (All versions < V0.9.6). The OpenV2G EXI parsing feature is missing a length check when parsi CVE-2025-249579.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_soc CVE-2025-249588.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` CVE-2025-249591.0zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variabl CVE-2025-249608.7Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(