CVE-2025-48201

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-425

Affected software

No affected versions have been published.

Timeline

Published
May 21, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-482025.3The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-482036.4The cs_seo extension through 9.2.0 for TYPO3 allows XSS.CVE-2025-482046.8The ns_backup extension through 13.0.0 for TYPO3 allows command injection.CVE-2025-482058.6The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-482066.1The ns_backup extension through 13.0.0 for TYPO3 allows XSS.CVE-2025-482078.6The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-482088.8Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The attCVE-2025-48217.5Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rateCVE-2025-482193.5O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS (IP Multimedia Subsystem) callCVE-2025-48229.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bayraktar Solar Energies ScadaWatt OtoCVE-2025-48238.8A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue CVE-2025-482316.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Fo
CVE-2025-48201: High severity, CVSS 8.6 | Vulnix