CVE-2025-57714

HighCVSS 7.8/10Last modified Oct 18, 2026

Description

An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version: NetBak Replicator 4.5.15.0807 and later

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-577167.3An Uncontrolled Search Path Element vulnerability [CWE-427] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versio CVE-2025-577277.5In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference CVE-2025-577286.5In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files CVE-2025-577297.3In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start CVE-2025-577304.6In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature CVE-2025-577315.4In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content CVE-2025-577326.3In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership CVE-2025-577333.8In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content CVE-2025-577346.5In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files CVE-2025-577359.1When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it CVE-2025-577387.2Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations CVE-2025-577398.8An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet For