CVE-2025-70873

HighCVSS 7.5/10Last modified Oct 15, 2026

Description

An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-244

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	RUGGEDCOM CROSSBOW Station Access Controller (SAC)	< V6.0

References

https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054Exploit, Third Party Advisory
https://sqlite.org/forum/forumpost/761eac3c82Issue Tracking
https://sqlite.org/src/info/3d459f1fb1bd1b5eIssue Tracking, Patch
https://cert-portal.siemens.com/productcert/html/ssa-765416.html

Timeline

Published: Mar 12, 2026
Last modified: Oct 15, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-70888.8A vulnerability, which was classified as critical, was found in Belkin F9K1122 1.00.33. This affects the function formPPPoESetup of the file CVE-2025-708867.5An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submi CVE-2025-708878.8An issue in ralphje Signify before v.0.9.2 allows a remote attacker to escalate privileges via the signed_data.py and the context.py compone CVE-2025-708889.8An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c compon CVE-2025-70898.8A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. This issue affects the function formWanTcpipSetup of the fil CVE-2025-708906.1A stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0. An authenticated attacker can inject arbitrar CVE-2025-708916.1A stored cross-site scripting (XSS) vulnerability exists in Phpgurukul Cyber Cafe Management System v1.0 within the user management module. CVE-2025-708929.8Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to CVE-2025-708938.8A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminprofile.php endpoint. CVE-2025-708996.5PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can p CVE-2025-70908.8A vulnerability, which was classified as critical, has been found in Belkin F9K1122 1.00.33. Affected by this issue is the function formConn CVE-2025-70918.8A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. Affected is the function formWlanMP of the file /go