PT-2026-78896
CVE-2025-14602
·
Published
2026-08-20
·
Updated
2026-09-29
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
vsDesk versions prior to 14.0101
Description
The application uses a weak and predictable method based on the request timestamp to generate names for uploaded files. This flaw allows a remote attacker to guess or brute-force the generated filename within a short time window, enabling unauthorized access to uploaded files to facilitate further attacks.
Recommendations
Update to version 14.0101 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾