Verysync
Monthly
We need to produce a JSON object with all the specified fields, strictly plain text strings, no arrays/objects/nesting. Synthesize all provided data. CVE-2025-14199. Input: - Description: Verysync 微力同步 up to 2.21.3. Unknown function of file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false of Web Administration Module. Manipulation leads to unrestricted upload. Remote attack. Exploit published. Vendor contacted but no response. - CVSS Score: 2.1 (but vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... no CVSS 3.1 vector provided, only CVSS:4.0). The CVSS 4.0 vector score is 2.1. So it's low severity per this score. But CWE-284 Improper Access Control, and tags include Authentication Bypass and File Upload. Conflicting: CVSS 4.0 PR:L (low privileges required), but description says "unknown function", and maybe unrestricted upload could be more severe? But the CVSS 4.0 impact is low integrity, low availability, low confidentiality. That seems low. EPSS 0.06%, so very low exploitation probability. KEV not mentioned, so likely not in KEV. POC available (exploit published, reference link). So I'll treat it as publicly available exploit code. No KEV. Fields: - product_name: "Verysync" (微力同步 is the product, but just "Verysync"? The CPE says verysync:verysync, product is Verysync). So "Verysync" is fine. Max 3 words. - summary: Must synthesize, not paraphrase. Should mention impact (unrestricted file upload), product, version, exploitation status, EPSS low. Start with specific impact verb. "Unrestricted file upload in Verysync up to 2.21.3 allows remote attackers with low privileges to upload arbitrary files via the Web Administration Module, leading to potential integrity and availability impacts. Public exploit code exists, but EPSS predicts low exploitation probability." Note that vendor did not respond. Active exploitation not confirmed (no KEV). Authentication: CVSS 4.0 PR:L, so low privileges. So authenticated remote at
A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the component Web Administration Module. Performing manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
We need to produce a JSON object with all the specified fields, strictly plain text strings, no arrays/objects/nesting. Synthesize all provided data. CVE-2025-14199. Input: - Description: Verysync 微力同步 up to 2.21.3. Unknown function of file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false of Web Administration Module. Manipulation leads to unrestricted upload. Remote attack. Exploit published. Vendor contacted but no response. - CVSS Score: 2.1 (but vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... no CVSS 3.1 vector provided, only CVSS:4.0). The CVSS 4.0 vector score is 2.1. So it's low severity per this score. But CWE-284 Improper Access Control, and tags include Authentication Bypass and File Upload. Conflicting: CVSS 4.0 PR:L (low privileges required), but description says "unknown function", and maybe unrestricted upload could be more severe? But the CVSS 4.0 impact is low integrity, low availability, low confidentiality. That seems low. EPSS 0.06%, so very low exploitation probability. KEV not mentioned, so likely not in KEV. POC available (exploit published, reference link). So I'll treat it as publicly available exploit code. No KEV. Fields: - product_name: "Verysync" (微力同步 is the product, but just "Verysync"? The CPE says verysync:verysync, product is Verysync). So "Verysync" is fine. Max 3 words. - summary: Must synthesize, not paraphrase. Should mention impact (unrestricted file upload), product, version, exploitation status, EPSS low. Start with specific impact verb. "Unrestricted file upload in Verysync up to 2.21.3 allows remote attackers with low privileges to upload arbitrary files via the Web Administration Module, leading to potential integrity and availability impacts. Public exploit code exists, but EPSS predicts low exploitation probability." Note that vendor did not respond. Active exploitation not confirmed (no KEV). Authentication: CVSS 4.0 PR:L, so low privileges. So authenticated remote at
A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the component Web Administration Module. Performing manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.