CVE-2025-48783

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An external control of file name or path vulnerability in the delete file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to delete partial files by specifying arbitrary file paths.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-73

Affected software

Vendor	Product	Versions
Soar Cloud System CO., LTD.	HRD Human Resource Management System	<= 7.3.2025.0408

References

https://zuso.ai/advisory/za-2025-08Third Party Advisory

Timeline

Published: Jun 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-487847.5A missing authorization vulnerability in Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attacke CVE-2025-48797.8Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows CVE-2025-487955.6Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire t CVE-2025-487967.3A flaw was found in GIMP. The GIMP ani_load_image() function is vulnerable to a stack-based overflow. If a user opens.ANI files, GIMP may be CVE-2025-487977.3A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted b CVE-2025-487987.3A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an att CVE-2025-487997.8Improper link resolution before file access ('link following') in Windows Update Service allows an authorized attacker to elevate privileges CVE-2025-48809.8A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functi CVE-2025-488006.8Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2025-488026.5Improper certificate validation in Windows SMB allows an authorized attacker to perform spoofing over a network.CVE-2025-488036.7Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileg CVE-2025-488046.8Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature