Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by Verysync
CVE-2025-14199 (GCVE-0-2025-14199)
Vulnerability from nvd – Published: 2025-12-07 17:02 – Updated: 2025-12-08 17:12
VLAI
Title
Verysync 微力同步 Web Administration text.txt unrestricted upload
Summary
A flaw has been found in Verysync 微力同步 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false of the component Web Administration Module. Executing manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.334619 | vdb-entry |
| https://vuldb.com/?ctiid.334619 | signaturepermissions-required |
| https://vuldb.com/?submit.699539 | third-party-advisory |
| https://github.com/jjjjj-zr/jjjjjzr/issues/10 | exploitissue-tracking |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14199",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-08T17:02:56.716406Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T17:12:27.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/10"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Web Administration Module"
],
"product": "\u5fae\u529b\u540c\u6b65",
"vendor": "Verysync",
"versions": [
{
"status": "affected",
"version": "2.21.0"
},
{
"status": "affected",
"version": "2.21.1"
},
{
"status": "affected",
"version": "2.21.2"
},
{
"status": "affected",
"version": "2.21.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jjjjjzr (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Verysync \u5fae\u529b\u540c\u6b65 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false of the component Web Administration Module. Executing manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-07T17:02:06.806Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-334619 | Verysync \u5fae\u529b\u540c\u6b65 Web Administration text.txt unrestricted upload",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.334619"
},
{
"name": "VDB-334619 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.334619"
},
{
"name": "Submit #699539 | Beijing Weili Digital Technology Co., Ltd \u5fae\u529b\u540c\u6b65 v2.21.3 Upload Any File",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.699539"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/10"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-06T18:39:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "Verysync \u5fae\u529b\u540c\u6b65 Web Administration text.txt unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14199",
"datePublished": "2025-12-07T17:02:06.806Z",
"dateReserved": "2025-12-06T17:34:34.823Z",
"dateUpdated": "2025-12-08T17:12:27.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14198 (GCVE-0-2025-14198)
Vulnerability from nvd – Published: 2025-12-07 16:32 – Updated: 2025-12-08 17:12
VLAI
Title
Verysync 微力同步 Web Administration download information disclosure
Summary
A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the component Web Administration Module. Performing manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.334618 | vdb-entry |
| https://vuldb.com/?ctiid.334618 | signaturepermissions-required |
| https://vuldb.com/?submit.699533 | third-party-advisory |
| https://github.com/jjjjj-zr/jjjjjzr/issues/7 | exploitissue-tracking |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14198",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-08T17:03:03.743390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T17:12:34.833Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Web Administration Module"
],
"product": "\u5fae\u529b\u540c\u6b65",
"vendor": "Verysync",
"versions": [
{
"status": "affected",
"version": "2.21.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jjjjjzr (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Verysync \u5fae\u529b\u540c\u6b65 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the component Web Administration Module. Performing manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-07T16:32:06.232Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-334618 | Verysync \u5fae\u529b\u540c\u6b65 Web Administration download information disclosure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.334618"
},
{
"name": "VDB-334618 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.334618"
},
{
"name": "Submit #699533 | Beijing Weili Digital Technology Co., Ltd \u5fae\u529b\u540c\u6b65 v2.21.3 Download any file",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.699533"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/7"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-06T18:39:36.000Z",
"value": "VulDB entry last update"
}
],
"title": "Verysync \u5fae\u529b\u540c\u6b65 Web Administration download information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14198",
"datePublished": "2025-12-07T16:32:06.232Z",
"dateReserved": "2025-12-06T17:34:31.891Z",
"dateUpdated": "2025-12-08T17:12:34.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14197 (GCVE-0-2025-14197)
Vulnerability from nvd – Published: 2025-12-07 16:02 – Updated: 2025-12-08 15:54
VLAI
Title
Verysync 微力同步 Web Administration f96956469e7be39d information disclosure
Summary
A security vulnerability has been detected in Verysync 微力同步 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f96956469e7be39d of the component Web Administration Module. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.334617 | vdb-entry |
| https://vuldb.com/?ctiid.334617 | signaturepermissions-required |
| https://vuldb.com/?submit.699498 | third-party-advisory |
| https://vuldb.com/?submit.699537 | third-party-advisory |
| https://github.com/jjjjj-zr/jjjjjzr/issues/6 | issue-tracking |
| https://github.com/jjjjj-zr/jjjjjzr/issues/8 | exploitissue-tracking |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14197",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-08T15:53:57.568409Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T15:54:26.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Web Administration Module"
],
"product": "\u5fae\u529b\u540c\u6b65",
"vendor": "Verysync",
"versions": [
{
"status": "affected",
"version": "2.21.0"
},
{
"status": "affected",
"version": "2.21.1"
},
{
"status": "affected",
"version": "2.21.2"
},
{
"status": "affected",
"version": "2.21.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jjjjjzr (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Verysync \u5fae\u529b\u540c\u6b65 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f96956469e7be39d of the component Web Administration Module. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-07T16:02:05.996Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-334617 | Verysync \u5fae\u529b\u540c\u6b65 Web Administration f96956469e7be39d information disclosure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.334617"
},
{
"name": "VDB-334617 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.334617"
},
{
"name": "Submit #699498 | Beijing Weili Digital Technology Co., Ltd \u5fae\u529b\u540c\u6b65 v2.21.3 Unauthorized Access",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.699498"
},
{
"name": "Submit #699537 | Beijing Weili Digital Technology Co., Ltd \u5fae\u529b\u540c\u6b65 v2.21.3 Arbitrary File Read (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.699537"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/6"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/8"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-06T18:39:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "Verysync \u5fae\u529b\u540c\u6b65 Web Administration f96956469e7be39d information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14197",
"datePublished": "2025-12-07T16:02:05.996Z",
"dateReserved": "2025-12-06T17:34:10.995Z",
"dateUpdated": "2025-12-08T15:54:26.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14199 (GCVE-0-2025-14199)
Vulnerability from cvelistv5 – Published: 2025-12-07 17:02 – Updated: 2025-12-08 17:12
VLAI
Title
Verysync 微力同步 Web Administration text.txt unrestricted upload
Summary
A flaw has been found in Verysync 微力同步 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false of the component Web Administration Module. Executing manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.334619 | vdb-entry |
| https://vuldb.com/?ctiid.334619 | signaturepermissions-required |
| https://vuldb.com/?submit.699539 | third-party-advisory |
| https://github.com/jjjjj-zr/jjjjjzr/issues/10 | exploitissue-tracking |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14199",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-08T17:02:56.716406Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T17:12:27.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/10"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Web Administration Module"
],
"product": "\u5fae\u529b\u540c\u6b65",
"vendor": "Verysync",
"versions": [
{
"status": "affected",
"version": "2.21.0"
},
{
"status": "affected",
"version": "2.21.1"
},
{
"status": "affected",
"version": "2.21.2"
},
{
"status": "affected",
"version": "2.21.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jjjjjzr (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Verysync \u5fae\u529b\u540c\u6b65 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false of the component Web Administration Module. Executing manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-07T17:02:06.806Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-334619 | Verysync \u5fae\u529b\u540c\u6b65 Web Administration text.txt unrestricted upload",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.334619"
},
{
"name": "VDB-334619 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.334619"
},
{
"name": "Submit #699539 | Beijing Weili Digital Technology Co., Ltd \u5fae\u529b\u540c\u6b65 v2.21.3 Upload Any File",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.699539"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/10"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-06T18:39:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "Verysync \u5fae\u529b\u540c\u6b65 Web Administration text.txt unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14199",
"datePublished": "2025-12-07T17:02:06.806Z",
"dateReserved": "2025-12-06T17:34:34.823Z",
"dateUpdated": "2025-12-08T17:12:27.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14198 (GCVE-0-2025-14198)
Vulnerability from cvelistv5 – Published: 2025-12-07 16:32 – Updated: 2025-12-08 17:12
VLAI
Title
Verysync 微力同步 Web Administration download information disclosure
Summary
A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the component Web Administration Module. Performing manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.334618 | vdb-entry |
| https://vuldb.com/?ctiid.334618 | signaturepermissions-required |
| https://vuldb.com/?submit.699533 | third-party-advisory |
| https://github.com/jjjjj-zr/jjjjjzr/issues/7 | exploitissue-tracking |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14198",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-08T17:03:03.743390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T17:12:34.833Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Web Administration Module"
],
"product": "\u5fae\u529b\u540c\u6b65",
"vendor": "Verysync",
"versions": [
{
"status": "affected",
"version": "2.21.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jjjjjzr (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Verysync \u5fae\u529b\u540c\u6b65 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the component Web Administration Module. Performing manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-07T16:32:06.232Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-334618 | Verysync \u5fae\u529b\u540c\u6b65 Web Administration download information disclosure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.334618"
},
{
"name": "VDB-334618 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.334618"
},
{
"name": "Submit #699533 | Beijing Weili Digital Technology Co., Ltd \u5fae\u529b\u540c\u6b65 v2.21.3 Download any file",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.699533"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/7"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-06T18:39:36.000Z",
"value": "VulDB entry last update"
}
],
"title": "Verysync \u5fae\u529b\u540c\u6b65 Web Administration download information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14198",
"datePublished": "2025-12-07T16:32:06.232Z",
"dateReserved": "2025-12-06T17:34:31.891Z",
"dateUpdated": "2025-12-08T17:12:34.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14197 (GCVE-0-2025-14197)
Vulnerability from cvelistv5 – Published: 2025-12-07 16:02 – Updated: 2025-12-08 15:54
VLAI
Title
Verysync 微力同步 Web Administration f96956469e7be39d information disclosure
Summary
A security vulnerability has been detected in Verysync 微力同步 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f96956469e7be39d of the component Web Administration Module. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.334617 | vdb-entry |
| https://vuldb.com/?ctiid.334617 | signaturepermissions-required |
| https://vuldb.com/?submit.699498 | third-party-advisory |
| https://vuldb.com/?submit.699537 | third-party-advisory |
| https://github.com/jjjjj-zr/jjjjjzr/issues/6 | issue-tracking |
| https://github.com/jjjjj-zr/jjjjjzr/issues/8 | exploitissue-tracking |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14197",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-08T15:53:57.568409Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T15:54:26.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Web Administration Module"
],
"product": "\u5fae\u529b\u540c\u6b65",
"vendor": "Verysync",
"versions": [
{
"status": "affected",
"version": "2.21.0"
},
{
"status": "affected",
"version": "2.21.1"
},
{
"status": "affected",
"version": "2.21.2"
},
{
"status": "affected",
"version": "2.21.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jjjjjzr (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Verysync \u5fae\u529b\u540c\u6b65 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f96956469e7be39d of the component Web Administration Module. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-07T16:02:05.996Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-334617 | Verysync \u5fae\u529b\u540c\u6b65 Web Administration f96956469e7be39d information disclosure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.334617"
},
{
"name": "VDB-334617 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.334617"
},
{
"name": "Submit #699498 | Beijing Weili Digital Technology Co., Ltd \u5fae\u529b\u540c\u6b65 v2.21.3 Unauthorized Access",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.699498"
},
{
"name": "Submit #699537 | Beijing Weili Digital Technology Co., Ltd \u5fae\u529b\u540c\u6b65 v2.21.3 Arbitrary File Read (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.699537"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/6"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/8"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-06T18:39:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "Verysync \u5fae\u529b\u540c\u6b65 Web Administration f96956469e7be39d information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14197",
"datePublished": "2025-12-07T16:02:05.996Z",
"dateReserved": "2025-12-06T17:34:10.995Z",
"dateUpdated": "2025-12-08T15:54:26.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}