CVE-2025-4613

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-22

Affected software

VendorProductVersions
GoogleWeb Designer App< 16.3.0.0407

References

Timeline

Published
Jun 12, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-46142.7An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokensCVE-2025-461485.3In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.CVE-2025-461495.3In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.CVE-2025-46157.2An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authentCVE-2025-461505.3In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results.CVE-2025-461525.3In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the "other" argument.CVE-2025-461535.3PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implCVE-2025-461548.4Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.CVE-2025-461579.9An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment function in the leave requesCVE-2025-461586.2An issue in redoxOS kernel before commit 5d41cd7c allows a local attacker to cause a denial of service via the `setitimer` syscallCVE-2025-46161.1An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admiCVE-2025-46171.1An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin u