CVE-2025-2848
MEDIUMDescription
A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| synology | mail_server |
| synology | diskstation_manager |
| synology | mail_server |
| synology | diskstation_manager |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2025-2848? +
How severe is CVE-2025-2848? +
What products are affected by CVE-2025-2848? +
How do I check if I'm vulnerable to CVE-2025-2848? +
Related Vulnerabilities
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` …
Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the `actionSavePermissions()` endpoint allows a user with …
The <redacted>.exe or <redacted>.exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectively as any …
MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a broken access control vulnerability …
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoint loads and returns person …
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role …