CVE-2025-6240

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Improper Input Validation vulnerability in Profisee on Windows (filesystem modules) allows Path Traversal after authentication to the Profisee system.This issue affects Profisee: from 2020R1 before 2024R2.

Metrics

CVSS 4.0 5.0/10CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:M/U:Green

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jun 18, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-624006.5Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reCVE-2025-624014.3An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than alloweCVE-2025-624025.4API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the eCVE-2025-624037.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-624048.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-624058.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-624068.8Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sendCVE-2025-624076.1Frappe is a full-stack web application framework. Prior to 14.98.0 and 15.83.0, an open redirect was possible through the redirect argumentCVE-2025-624085.9c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer(CVE-2025-624097.5Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can CVE-2025-62414.4LsiAgent.exe, a component of SysTrack from Lakeside Software, attempts to load several DLL files which are not present in the default instalCVE-2025-624109.4In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in