CVE-2025-14849: High Unrestricted Upload in Advantech WebAccess/SCADA
CVE-2025-14849 is an unrestricted file upload in Advantech WebAccess/SCADA 9.2.1 that may lead to code execution. Update to version 9.2.2 and limit logins.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CVE-2025-14849 is an unrestricted file upload in Advantech WebAccess/SCADA 9.2.1 that may lead to code execution. Update to version 9.2.2 and limit logins.
CVE-2025-14833 is a SQL injection in code-projects Appointment Booking System with no fix listed. Limit access and use prepared statements in your copy.
CVE-2025-14832 is a SQL injection in itsourcecode Online Cake Ordering System with no fix listed. Limit access and use prepared statements in your copy.
CVE-2025-14711 is a SQL injection in FantasticLBP Hotels Server with no listed fix. Restrict access and switch the query to prepared statements.
CVE-2025-14710 is a SQL injection in FantasticLBP Hotels Server with no listed fix. Restrict access and switch the query to prepared statements.
CVE-2025-14704 is a path traversal in the /eshell API of the sgwbox N3 NAS 2.0.25. The vendor did not respond, so isolate the device from the internet.
CVE-2025-14673 is a heap buffer overflow in snap7-rs up to 1.142.1 (as_ct_write). No fix is listed. Check the project issue and your build first.
CVE-2025-14672 is a heap buffer overflow in snap7-rs up to 1.142.1 (opWriteArea). No fix is listed. Check the project issue and your own call paths.
CVE-2025-14668 is a SQL injection in Campcodes Online Examination System with no listed fix. Restrict access and switch the query to prepared statements.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.