CVE-2025-44012

MediumCVSS 6.5/10Last modified Oct 18, 2026

Description

An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-440136.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a us CVE-2025-440148.8An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exp CVE-2025-440158.4A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then e CVE-2025-440168.8A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows CVE-2025-440175.1"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user acc CVE-2025-440188.3A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lea CVE-2025-440197.1AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down c CVE-2025-440212.8OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the CVE-2025-440229.8An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism.CVE-2025-440236.5An issue in dlink DNS-320 v.1.00 and DNS-320LW v.1.01.0914.20212 allows an attacker to execute arbitrary via the account_mgr.cgi->cgi_chg_ad CVE-2025-440246.1Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficien CVE-2025-44039.8The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, a