CVE-2025-49197

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-328

Affected software

No affected versions have been published.

Timeline

Published
Jun 12, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-491987.5The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by cCVE-2025-491999.8The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-uploCVE-2025-492007.5The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompresCVE-2025-492019.8A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all veCVE-2025-492117.8A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affectedCVE-2025-492129.8An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeCVE-2025-492139.8An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeCVE-2025-492148.8An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code exCVE-2025-492158.8A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges oCVE-2025-492169.8An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as CVE-2025-492179.8An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeCVE-2025-492187.8A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges o
CVE-2025-49197: High severity, CVSS 7.5 | Vulnix