CVE-2025-27926

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-276 CWE-522

Affected software

Vendor	Product	Versions
Nintex	Automation	>= 5.6, < 5.8

References

https://help.nintex.com/en-US/platform/ReleaseNotes/K2Five.htmRelease Notes

Timeline

Published: Mar 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-279275.3An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.CVE-2025-279295.3Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.CVE-2025-27935.4IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0 CVE-2025-279305.4Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory mon CVE-2025-279316.5An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Editor version 10.5.2.395. By using a specially crafted CVE-2025-279328.1Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file deletion process of the USB storage CVE-2025-279334.3Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allo CVE-2025-279347.5Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If CVE-2025-279358.6The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the auth CVE-2025-279365.9Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform co CVE-2025-279377.1Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If e CVE-2025-279385.3Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").