PT-2025-51189 · Smartbi · Smartschool App

Lu1U · Published 2025-12-15 · Updated 2025-12-15 · CVE-2025-14702

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Smartbit CommV Smartschool App versions up to 10.4.4

Description A flaw exists in Smartbit CommV Smartschool App, potentially allowing path traversal. The issue impacts an unknown function within the be.smartschool.mobile.SplashActivity component and requires local access for exploitation. The exploit has been published. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Update Smartbit CommV Smartschool App to a version newer than 10.4.4.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-14702

Affected Products

Smartschool App

References · 7

• 🔥 https://github.com/Secsys-FDU/AF_CVEs/issues/4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14702 · Security Note
• https://vuldb.com/?id.336419 · Note
• https://vuldb.com/?ctiid.336419 · Note
• https://twitter.com/CVEnew/status/2000611233180065929 · Twitter Post
• https://t.me/CVEtracker/39797 · Telegram Post
• https://vuldb.com/?submit.706220 · Note