CVE-2025-11020CWE-22CWE-434CWE-89path-traversalunrestricted-file-uploadsql-injection

CVE-2025-11020

High · published October 2, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with Dangerous Type vulnerability in MarkAny SafePC Enterprise on Windows, Linux.This issue affects SafePC Enterprise: V7.0.* (V7.0.YYYY.MM.DD) before V7.0.1, and V5.*.*.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.7th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-10-02T10:15Z
References (1)
https://www.markany.com/enterprisesecurity?utm_campaign=markany_sa&utm_source=google_pc&utm_medium=gsa_pc&utm_term=cybersecurity&utm_content=&gad_source=1&gad_campaignid=21853187406&gbraid=0AAAAADOrb0lM8ZHyDytvnVwj9T--km9aM&gclid=Cj0KCQjwovPGBhDxARIsAFhgkwSh0F9hnsAoRTS8OnFI3KcF4_UMarYchq0uP5V1DiSQyKKVLdZPJNYaAiBuEALw_wcB · 09832df1-09c1-45b4-8a85-16c601d30feb
EPSS history
Timeline
  • 02 OCT 05:15Z
    Remote Code Execution in MarkAny SafePC Enterprise
    cvelistv5