PT-2025-17712 · Unknown · Database Toolset

Youcef Hamdani · Published 2025-04-24 · Updated 2025-04-29 · CVE-2025-3065

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Database Toolset plugin versions 1.8.4 and earlier

Description The issue is related to insufficient file path validation in a function, allowing unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution when the right file is deleted, such as wp-config.php.

Recommendations For versions 1.8.4 and earlier, update to version 1.8.5 to patch this critical issue. As a temporary workaround, consider restricting access to sensitive files on the server to minimize the risk of exploitation.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-3065

Affected Products

Database Toolset

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-3065 · Security Note
• https://twitter.com/CVEnew/status/1915329397407535186 · Twitter Post
• https://twitter.com/cracbot/status/1917172077641060811 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0e656123-cae4-4e0c-a80a-98526be293a8?source=cve · Note
• https://twitter.com/CveFindCom/status/1915330927321895286 · Twitter Post
• https://wordpress.org/plugins/database-toolset · Note
• https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-database-toolset-admin.php#L109 · Note
• https://twitter.com/cybercronai/status/1915421345954869734 · Twitter Post
• https://twitter.com/vulns_space/status/1915344606444614093 · Twitter Post
• https://t.me/cvedetector/23665 · Telegram Post
• https://t.me/cvetracker/22271 · Telegram Post
• https://t.me/purp_sec/564 · Telegram Post
• https://twitter.com/SecAideInfo/status/1916073063667449955 · Twitter Post