CVE-2025-27127

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 4), Totally Integrated Automation Portal (TIA Portal) V20 (All versions < V20 Update 3). The affected application improperly handles uploaded projects in the document root. This could allow an attacker with contributor privileges to cause denial of service by uploading a malicious project.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-271287.8in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.CVE-2025-271299.8An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted CVE-2025-27137.8Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, w CVE-2025-271308.8Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited,CVE-2025-271315.5in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input.CVE-2025-271327.8in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. CVE-2025-271338.8WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3 CVE-2025-271348.8Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to CVE-2025-271359.8RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL CVE-2025-271365.5LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoin CVE-2025-271374.4Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Depend CVE-2025-271389.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication