CVE-2025-48501

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where the product is running.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
NimesaNimesa Backup and Recoveryv2.3
NimesaNimesa Backup and Recoveryv2.4

References

Timeline

Published
Jul 7, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-485025.5Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial oCVE-2025-485037.8A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting inCVE-2025-485046.8Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisorCVE-2025-485051.0Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged eCVE-2025-485064.6Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, CVE-2025-485078.6The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors accesCVE-2025-485086.0Improper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual machine to control CVE-2025-485091.8Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of CVE-2025-48519.8A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUsCVE-2025-485107.1Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availaCVE-2025-485115.5Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in crCVE-2025-485127.0Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attack
CVE-2025-48501: Critical severity, CVSS 9.3 | Vulnix