CVE-2025-8861

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Aug 29, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-88627.0YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigat CVE-2025-88637.0YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission CVE-2025-88646.8Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs CVE-2025-88654.1The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when processing certain CVE-2025-88665.1YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attack CVE-2025-88676.4The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget param CVE-2025-88688.8In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate CVE-2025-88695.9When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement P CVE-2025-88704.9On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153 CVE-2025-88715.6The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deseriali CVE-2025-88726.5On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSFPv3 process to have high CPU ut CVE-2025-88737.5On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IP