CVE-2025-54460

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publication targets of type Text File or HDFS) to upload and persist files that could potentially be executed.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Aug 21, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-544616.9ChatLuck contains an insufficient granularity of access control vulnerability in Invitation of Guest Users. If exploited, an uninvited guestCVE-2025-544629.8A heap-based buffer overflow vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVE-2025-544637.5Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant CVE-2025-544647.0This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attackerCVE-2025-544656.8This vulnerability exists in ZKTeco WL20 due to hard-coded MQTT credentials and endpoints stored in plaintext within the device firmware. AnCVE-2025-544669.8Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue CVE-2025-544675.3When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in CVE-2025-544684.7A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for eCVE-2025-544699.9A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generateCVE-2025-54479.8A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.0CVE-2025-544708.6This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled,CVE-2025-544716.5NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret