CVE-2025-48443

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege Escalation Vulnerability that could allow a local attacker to leverage this vulnerability to delete files in the context of an administrator when the administrator installs Trend Micro Password Manager.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-64

Affected software

Vendor	Product	Versions
Trend Micro, Inc.	Trend Micro Password Manager	>= 5.0, < 5.8.0.1330

References

https://helpcenter.trendmicro.com/en-us/article/TMKA-12917Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-25-361/Third Party Advisory

Timeline

Published: Jun 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-484445.3Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 befo CVE-2025-484458.8Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Euroban CVE-2025-484468.8Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphaban CVE-2025-484477.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site CVE-2025-484486.5Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affect CVE-2025-48459.8A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functi CVE-2025-484595.3Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recom CVE-2025-48469.8A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component MPUT CVE-2025-484615.0Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as CVE-2025-484624.2Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from loggi CVE-2025-484633.1Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as CVE-2025-484644.7Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as