CVE-2025-8450

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-306 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Aug 19, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-84516.4The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site CVE-2025-84524.3By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that CVE-2025-84536.7CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privil CVE-2025-84549.8It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of sc CVE-2025-84567.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kod8 Software Technologies Trad CVE-2025-84595.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Moni CVE-2025-84604.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Noti CVE-2025-84617.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Seres Software syWEB allows Ref CVE-2025-84626.4The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the social URL par CVE-2025-84635.3Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This i CVE-2025-84645.3The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, a CVE-2025-84669.8A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of th