{"id":"CVE-2025-11020","aliases":["EUVD-2025-32677","GHSA-x5h3-2jj8-3f8q"],"status":"published","title":"Remote Code Execution in MarkAny SafePC Enterprise","description":"An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with Dangerous Type vulnerability in MarkAny SafePC Enterprise on Windows, Linux.This issue affects SafePC Enterprise: V7.0.* (V7.0.YYYY.MM.DD) before V7.0.1, and V5.*.*.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00301,"percentile":0.23151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-434","CWE-89"],"published":"2025-10-02T05:15:50Z","modified":"2026-10-12T15:10:00Z","products":[{"vendor":"markany","product":"safepc enterprise"}],"references":[{"url":"https://www.markany.com/enterprisesecurity?utm_campaign=markany_sa\u0026utm_source=google_pc\u0026utm_medium=gsa_pc\u0026utm_term=cybersecurity\u0026utm_content=\u0026gad_source=1\u0026gad_campaignid=21853187406\u0026gbraid=0AAAAADOrb0lM8ZHyDytvnVwj9T--km9aM\u0026gclid=Cj0KCQjwovPGBhDxARIsAFhgkwSh0F9hnsAoRTS8OnFI3KcF4_UMarYchq0uP5V1DiSQyKKVLdZPJNYaAiBuEALw_wcB"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11020"},{"url":"https://github.com/advisories/GHSA-x5h3-2jj8-3f8q"}],"sources":{"cve":[{"id":"CVE-2025-11020","title":"Remote Code Execution in MarkAny SafePC Enterprise","description":"An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with Dangerous Type vulnerability in MarkAny SafePC Enterprise on Windows, Linux.This issue affects SafePC Enterprise: V7.0.* (V7.0.YYYY.MM.DD) before V7.0.1, and V5.*.*.","status":"published","published":"2025-10-02T05:15:50.859Z","modified":"2025-10-02T15:53:44.53Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89","CWE-22","CWE-434"],"updated_at":"2026-11-02T14:32:51.199669Z"}],"euvd":[{"id":"EUVD-2025-32677","description":"An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with Dangerous Type vulnerability in MarkAny SafePC Enterprise on Windows, Linux.This issue affects SafePC Enterprise: V7.0.* (V7.0.YYYY.MM.DD) before V7.0.1, and V5.*.*.","status":"published","published":"2025-10-02T05:15:50Z","modified":"2025-10-02T15:53:44Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high"}],"updated_at":"2026-11-02T20:31:37.123578Z"}],"ghsa":[{"id":"GHSA-x5h3-2jj8-3f8q","title":"An attacker can obtain server information using Path Traversal vulnerability to conduct SQL...","description":"An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with Dangerous Type vulnerability in MarkAny SafePC Enterprise on Windows, Linux.This issue affects SafePC Enterprise: V7.0.* (V7.0.YYYY.MM.DD) before V7.0.1, and V5.*.*.","status":"published","published":"2025-10-02T06:31:07Z","modified":"2025-10-02T06:31:15Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:03:50.19975Z"}],"nvd":[{"id":"CVE-2025-11020","description":"An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with Dangerous Type vulnerability in MarkAny SafePC Enterprise on Windows, Linux.This issue affects SafePC Enterprise: V7.0.* (V7.0.YYYY.MM.DD) before V7.0.1, and V5.*.*.","status":"published","published":"2025-10-02T06:15:34.177Z","modified":"2026-10-12T15:10:00.207Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-89","CWE-434"],"updated_at":"2026-11-02T14:11:34.090044Z"}]}}