CVE-2025-48781

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to obtain partial files by specifying arbitrary file paths.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published
Jun 6, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-487829.8An unrestricted upload of file with dangerous type vulnerability in the upload file function of Soar Cloud HRD Human Resource Management SysCVE-2025-487837.5An external control of file name or path vulnerability in the delete file function of Soar Cloud HRD Human Resource Management System througCVE-2025-487847.5A missing authorization vulnerability in Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackeCVE-2025-48797.8Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for WindowsCVE-2025-487955.6Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire tCVE-2025-487967.3A flaw was found in GIMP. The GIMP ani_load_image() function is vulnerable to a stack-based overflow. If a user opens.ANI files, GIMP may beCVE-2025-487977.3A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted bCVE-2025-487987.3A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attCVE-2025-487997.8Improper link resolution before file access ('link following') in Windows Update Service allows an authorized attacker to elevate privilegesCVE-2025-48809.8A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functiCVE-2025-488006.8Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2025-488026.5Improper certificate validation in Windows SMB allows an authorized attacker to perform spoofing over a network.