CVE-2025-6249

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions access to application data.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-602

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-624908.8In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, pr CVE-2025-624918.8A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled reject CVE-2025-624926.5A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implementation of TypedArray.prototy CVE-2025-624936.5A vulnerability exists in the QuickJS engine's BigInt string conversion logic (js_bigint_to_string1) due to an incorrect calculation of the CVE-2025-624948.8A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first c CVE-2025-624958.8An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the b CVE-2025-624968.8A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attempting to create a BigInt from a CVE-2025-624976.5Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a user accesses a specially crafted webpage wh CVE-2025-624988.8A relative path traversal (ZipSlip) vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows CVE-2025-624994.6Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an CVE-2025-62506.7Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper prot CVE-2025-625007.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker co