CVE-2025-52997

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-307 CWE-521 CWE-1392

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-529989.8Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be CVE-2025-529998.7jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions CVE-2025-530007.8The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to CVE-2025-530029.8LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions CVE-2025-530038.2The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results CVE-2025-530049.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in D CVE-2025-530059.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in D CVE-2025-530069.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apa CVE-2025-530078.9arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response Splitting vulnerability.CVE-2025-530086.5GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk CVE-2025-530097.5MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions CVE-2025-53016.1ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening