CVE-2025-58456

MediumCVSS 6.8/10Last modified Oct 18, 2026

Description

A relative path traversal vulnerability was discovered in Productivity Suite software version

4.4.1.19.

The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read arbitrary files on the target machine.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published: Oct 23, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-584574.3Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions CVE-2025-584584.3In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the CVE-2025-584594.3Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing atta CVE-2025-58464.3An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that CVE-2025-584604.2A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission CVE-2025-584629.8OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticat CVE-2025-584634.9A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, t CVE-2025-584647.5A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker, they can then exploit the vulnerability t CVE-2025-584655.4A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can CVE-2025-584664.9A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains CVE-2025-584676.5A relative path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then CVE-2025-584688.8A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the