CVE-2025-49152

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-491539.3The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code.CVE-2025-491547.8An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker tCVE-2025-491558.8An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject maliciouCVE-2025-491567.8A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected insCVE-2025-491577.8A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on afCVE-2025-491587.8An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges oCVE-2025-49169.8A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been rated as critical. This issue affects some unknowCVE-2025-491626.4Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character alloCVE-2025-491636.7Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file.CVE-2025-491644.3Arris VIP1113 devices through 2025-05-30 with KreaTV SDK have a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f5CVE-2025-49179.8A vulnerability classified as critical has been found in PHPGurukul Auto Taxi Stand Management System 1.0. Affected is an unknown function oCVE-2025-491756.1A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least o