CVE-2025-30028

HighCVSS 8.6/10Last modified Oct 7, 2026

Description

A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2026
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-30036.3A vulnerability, which was classified as critical, was found in ESAFENET CDG 3. Affected is an unknown function of the file /CDGServer3/UserCVE-2025-300308.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injCVE-2025-300318.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injCVE-2025-300328.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injCVE-2025-300337.8The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user iCVE-2025-300345.5A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not properly validate input CVE-2025-300359.0The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplyingCVE-2025-300368.8Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrCVE-2025-300378.8The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal services, but are insCVE-2025-300387.3The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-iCVE-2025-300399.0Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the systCVE-2025-30045.4A vulnerability has been found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this vulnerability is an unkno
CVE-2025-30028: High severity, CVSS 8.6 | Vulnix