First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-48206

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The ns_backup extension through 13.0.0 for TYPO3 allows XSS.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
TYPO3	ns backup extension	< 13.0.1

References

https://typo3.org/security/advisory/typo3-ext-sa-2025-007Vendor Advisory

Timeline

Published: May 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-482078.6The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-482088.8Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The att CVE-2025-48217.5Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate CVE-2025-482193.5O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS (IP Multimedia Subsystem) call CVE-2025-48229.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bayraktar Solar Energies ScadaWatt Oto CVE-2025-48238.8A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue CVE-2025-482316.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Fo CVE-2025-482326.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Addons For Beaver Builder – CVE-2025-482337.1Cross-Site Request Forgery (CSRF) vulnerability in affmngr Affiliates Manager Google reCAPTCHA Integration affiliates-manager-google-recaptc CVE-2025-482346.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultima CVE-2025-482356.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bogdan Bendziukov WP Image Mask wp-ima CVE-2025-482368.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bunny.net bunny.net bunnycdn allows St

CVE-2025-48206: Medium severity, CVSS 6.1 | Vulnix