CVE-2025-14265

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.

• CWE-494

• https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patchVendor Advisory

Published

Dec 11, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14257A flaw has been found in itsourcecode Student Management Sys…9.8
• CVE-2025-14258A vulnerability has been found in itsourcecode Student Manag…9.8
• CVE-2025-14259A vulnerability was found in Jihai Jshop MiniProgram Mall Sy…6.3
• CVE-2025-1426Heap buffer overflow in GPU in Google Chrome on Android prio…8.8
• CVE-2025-14261The Litmus platform uses JWT for authentication and authoriz…7.1
• CVE-2025-14262A wrong permission check in KNIME Business Hub before versio…4.3
• CVE-2025-14266CSRF in Ercom Cryptobox administration console allows attack…0.6
• CVE-2025-14267Incomplete removal of sensitive information before transfer …4.9
• CVE-2025-14268Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-1427A maliciously crafted CATPRODUCT file, when parsed through A…7.8
• CVE-2025-14270The OneClick Chat to Order plugin for WordPress is vulnerabl…2.7
• CVE-2025-14271Rejected reason: This CVE ID has been withdrawn by its CVE N…