CVE-2025-25048

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files to the system due to improper neutralization of sequences that can resolve to a restricted directory.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-25059.8The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' paramCVE-2025-250508.8An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell ControlVault3 prior to 5.15.10.14 and DCVE-2025-250516.1An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for latCVE-2025-250525.5in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through buffer overflow.CVE-2025-250538.8OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitraryCVE-2025-250546.1Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication pluCVE-2025-250555.3Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. CVE-2025-250564.3Cross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views a malicious page while logged in, uniCVE-2025-250575.5in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.CVE-2025-250583.3Improper initialization for some ESXi kernel mode driver for the Intel(R) Ethernet 800-Series before version 2.2.2.0 (esxi 8.0) & 2.2.3.CVE-2025-250596.7Uncontrolled search path for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User ApplicatCVE-2025-25065.3When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access t