CVE-2025-49186

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published
Jun 12, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-491875.3For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect passwoCVE-2025-491887.5The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering.CVE-2025-491896.1The HttpOnlyflag of the session cookie \"@@\" is set to false. Since this flag helps preventing access to cookies via client-side scripts, sCVE-2025-49198.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability wasCVE-2025-491905.8The application is vulnerable to Server-Side Request Forgery (SSRF). An endpoint can be used to send server internal requests to other portsCVE-2025-491916.1Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, CVE-2025-491926.1The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a userCVE-2025-491936.1The application fails to implement several security headers. These headers help increase the overall security level of the web application bCVE-2025-491947.5The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to inteCVE-2025-491959.8The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentialCVE-2025-491969.1A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in uCVE-2025-491977.5The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user accou
CVE-2025-49186: Medium severity, CVSS 6.5 | Vulnix