CVE-2025-14602mediumCWE-340CWE-377

CVE-2025-14602: falha de média gravidade em vsDesk

Weak File Name Generation in vsDesk

Publicada em

Seguir esta CVE+ Monitorar vsDesk

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
vsDesk · vsDesk
CVEs relacionadas — vsDesk

No mesmo produto, das mais perigosas para as menos.

CVE-2025-14601HIGHvsDesk Task Scheduler OS Command InjectionEPSS 1.1%CVE-2026-2334CRITICAL) Missing Server-Side File Extension Validation in vsDeskEPSS 0.7%CVE-2025-14600CRITICALAdmin Account Takeover via Path Traversal in vsDeskEPSS 0.5%CVE-2025-14603HIGHUse of user input in raw SQL queries in vsDesk leading to blind SQL injectionEPSS 0.4%