A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the component Web Administration Module. Performing manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://github.com/jjjjj-zr/jjjjjzr/issues/7 | Exploit Third Party Advisory Issue Tracking |
| https://vuldb.com/?ctiid.334618 | Permissions Required VDB Entry |
| https://vuldb.com/?id.334618 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.699533 | Third Party Advisory VDB Entry |
| https://github.com/jjjjj-zr/jjjjjzr/issues/7 | Exploit Third Party Advisory Issue Tracking |
Configurations
History
11 Dec 2025, 18:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/jjjjj-zr/jjjjjzr/issues/7 - Exploit, Third Party Advisory, Issue Tracking | |
| References | () https://vuldb.com/?ctiid.334618 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.334618 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.699533 - Third Party Advisory, VDB Entry | |
| CPE | cpe:2.3:a:verysync:verysync:*:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Verysync verysync
Verysync |
08 Dec 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/jjjjj-zr/jjjjjzr/issues/7 - |
07 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-07 17:15
Updated : 2025-12-11 18:08
NVD link : CVE-2025-14198
Mitre link : CVE-2025-14198
CVE.ORG link : CVE-2025-14198
JSON object : View
Products Affected
verysync
- verysync
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-284Improper Access Control
NVD-CWE-noinfo