CVE-2025-49089

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Sep 15, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-49097.3A vulnerability classified as critical was found in SourceCodester Client Database Management System 1.0. This vulnerability affects unknownCVE-2025-490907.1The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution.CVE-2025-490918.2KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a sCVE-2025-49109.8A vulnerability, which was classified as critical, has been found in PHPGurukul Zoo Management System 2.1. This issue affects some unknown pCVE-2025-49119.8A vulnerability, which was classified as critical, was found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of theCVE-2025-491123.1setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev->size - prev->used.CVE-2025-491138.8Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in aCVE-2025-49129.1A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as critical. Affected by this vulnerabiCVE-2025-491248.4Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icaclCVE-2025-491257.5Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted oCVE-2025-491268.8Visionatrix is an AI Media processing tool using ComfyUI. In versions 1.5.0 to before 2.5.1, the /docs/flows endpoint is vulnerable to a RefCVE-2025-491278.9Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any un
CVE-2025-49089: Medium severity, CVSS 6.3 | Vulnix