CVE-2025-40737

A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privileges (ZDI-CAN-26571).

• CWE-22

• https://cert-portal.siemens.com/productcert/html/ssa-078892.htmlVendor Advisory

Published

Jul 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-40731SQL injection vulnerability in Daily Expense Manager v1.0. T…9.8
• CVE-2025-40732user enumeration vulnerability in Daily Expense Manager v1.0…7.5
• CVE-2025-40733Reflected Cross-Site Scripting (XSS) vulnerability in Daily …6.1
• CVE-2025-40734Reflected Cross-Site Scripting (XSS) vulnerability in Daily …6.1
• CVE-2025-40735A vulnerability has been identified in SINEC NMS (All versio…8.8
• CVE-2025-40736A vulnerability has been identified in SINEC NMS (All versio…9.8
• CVE-2025-40738A vulnerability has been identified in SINEC NMS (All versio…8.8
• CVE-2025-40739A vulnerability has been identified in Solid Edge SE2025 (Al…7.8
• CVE-2025-4074A vulnerability was found in PHPGurukul Curfew e-Pass Manage…9.8
• CVE-2025-40740A vulnerability has been identified in Solid Edge SE2025 (Al…7.8
• CVE-2025-40741A vulnerability has been identified in Solid Edge SE2025 (Al…7.8
• CVE-2025-40742A vulnerability has been identified in SIPROTEC 5 6MD84 (CP3…6