CVE-2025-14199
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability was found in Verysync 微力同步 up to 2.21.3, affecting an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false in the Web Administration Module. Manipulation can lead to unrestricted upload, and the attack may be performed remotely.
Risk Assessment
A remote attacker can upload arbitrary files to the server, potentially leading to code execution or system compromise. The exploit has been publicly disclosed and may be used.
Recommendation
As the vendor did not respond, consider restricting access to the web interface and monitoring for unusual file uploads until a fix is released.
Other vulnerabilities in Verysync
See all- CVE-2025-14198Medium
A vulnerability was detected in Verysync 微力同步 2.21.3 affecting the Web Administration Module, specifically the file /safebrowsing/clientreport/download. Manipulation results in information disclosure and the attack can be carried out remotely. The exploit is now public and the vendor did not respond to the disclosure.
- CVE-2025-14197Medium
A security vulnerability has been detected in Verysync 微力同步 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f96956469e7be39d of the component Web Administration Module. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A flaw has been found in Verysync 微力同步 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false of the component Web Administration Module. Executing manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS