CVE-2025-14253
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
Risk Assessment
A privileged remote attacker can read arbitrary system files, potentially leading to the disclosure of sensitive information such as configuration data or credentials.
Recommendation
Apply available security updates for Vitals ESP from Galaxy Software Services or contact the vendor for a fix.
Other vulnerabilities in Vitals ESP
See all- CVE-2025-14255Medium
Vitals ESP by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
- CVE-2025-14254Medium
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Original NVD description (English source)
Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS