CVE-2025-48459

MediumCVSS 5.3/10Last modified Sep 26, 2026

Description

Deserialization of Untrusted Data vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 2.0.5.

Users are recommended to upgrade to version 2.0.5, which fixes the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
Apache Software FoundationApache IoTDB>= 1.0.0, < 2.0.5

References

Timeline

Published
Sep 24, 2025
Last modified
Sep 26, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-48469.8A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component MPUTCVE-2025-484615.0Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover asCVE-2025-484624.2Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from loggiCVE-2025-484633.1Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as CVE-2025-484644.7Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as CVE-2025-484668.1Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate DigitaCVE-2025-484676.5Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-servCVE-2025-484686.4Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firCVE-2025-484699.6Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentCVE-2025-48479.8A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the componCVE-2025-484704.1Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fieCVE-2025-484719.8FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, the application does not check or performs insuffici
CVE-2025-48459: Medium severity, CVSS 5.3 | Vulnix