CVE-2025-64298

HighCVSS 7.5/10Last modified Sep 25, 2026

Description

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and configuration files, which can contain sensitive data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Dec 2, 2025
Last modified
Sep 25, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-642992.7LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes.CVE-2025-64306.1When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<CVE-2025-643017.8An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker cCVE-2025-643025.4Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosuCVE-2025-643045.1"FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys.CVE-2025-643056.5MicroServer copies parts of the system firmware to an unencrypted external SD card on boot, which contains user and vendor secrets. An attacCVE-2025-643076.5The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit CVE-2025-643086.5The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documenCVE-2025-643097.4The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users wheCVE-2025-64316.5When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker couCVE-2025-643109.8EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrativCVE-2025-643115.5Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentia