CVE-2025-8312

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a deadlock occurring in the scheduling service.This issue affects the following version(s) :

* Devolutions Server 2025.2.2.0 through 2025.2.5.0 * Devolutions Server 2025.1.12.0 and earlier

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

Weakness enumeration

CWE-833

Affected software

Vendor	Product	Versions
Devolutions	Server	>= 2025.2.2.0, <= 2025.2.5.0; <= 2025.1.13.0

References

https://devolutions.net/security/advisories/DEVO-2025-0013/Vendor Advisory

Timeline

Published: Jul 30, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-83136.4The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up t CVE-2025-83146.4The Software Issue Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg parameter in all versions CVE-2025-83156.4The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to CVE-2025-83166.4The Certifica WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘evento’ parameter in all versions up to, and inc CVE-2025-83176.4The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and CVE-2025-83186.4The Jobify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘keyword’ parameter in all versions up to, and includin CVE-2025-83196.1the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL CVE-2025-83208.8Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability. This vulnerability allows network-CVE-2025-83216.8Tesla Wall Connector Firmware Downgrade Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on a CVE-2025-83228.8The e-School from Ventem has a Missing Authorization vulnerability, allowing remote attackers with regular privilege to access administrator CVE-2025-83238.8The e-School from Ventem has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shel CVE-2025-83249.8Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter conf