CVE-2025-49155

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-491567.8A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected ins CVE-2025-491577.8A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on af CVE-2025-491587.8An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges o CVE-2025-49169.8A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been rated as critical. This issue affects some unknow CVE-2025-491626.4Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character allo CVE-2025-491636.7Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file.CVE-2025-491644.3Arris VIP1113 devices through 2025-05-30 with KreaTV SDK have a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f5 CVE-2025-49179.8A vulnerability classified as critical has been found in PHPGurukul Auto Taxi Stand Management System 1.0. Affected is an unknown function o CVE-2025-491756.1A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least o CVE-2025-491767.3A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, pote CVE-2025-491776.1A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client CVE-2025-491785.5A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processin