Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-29454: Personal Management System 1.4.65 allows sensitive data exposure via upload

CVE-2025-29454 · published 1 year ago

Summary

The Personal Management System version 1.4.65 has a security weakness in the Upload function, which can allow an attacker to access sensitive information. This means that if your business uses this system, you should consider upgrading to a newer version that fixes this issue or taking other protective measures to prevent unauthorized access to sensitive data.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
personal-management-system	personal_management_system	1.4.65 `cpe:2.3:a:personal-management-system:personal_management_system:1.4.65:::::::*`

Original advisory text

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function.

References

https://www.yuque.com/morysummer/vx41bz/cyql4n0xiubspntl URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29454... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-29454 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published17 Apr 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-29454 · NVD

CVE-2025-29454 · OSV

Track software like this

Free during beta