CVE-2025-48493

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs. Version 2.0.20 fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Jun 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-484945.4Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cro CVE-2025-484955.4Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, a CVE-2025-484965.1Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under th CVE-2025-484975.1Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL whi CVE-2025-484987.5A null pointer dereference vulnerability exists in the Distributed Transaction component of Bloomberg Comdb2 8.1 when processing a number of CVE-2025-484995.3Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (CVE-2025-48506.3A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of CVE-2025-485007.3A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker CVE-2025-485019.3An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS comman CVE-2025-485025.5Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial o CVE-2025-485037.8A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in CVE-2025-485051.0Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged e