VDB

GCVE-VVD-NCSC-2025-301

GCVE-VVD-NCSC-2025-301
Advisory PublishedCVSS 8.5/10
Vulnetix · Advisory published September 30, 2025
VMware vCenter has an SMTP header injection vulnerability that allows non-administrative users with scheduled task permissions to manipulate notification emails.
Download JSON Open in Console

Weaknesses (CWE)

CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')CWE-640Weak Password Recovery Mechanism for Forgotten PasswordCWE-203Observable Discrepancy

Risk Scores

CVSS 3.1
8.5/10
High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Affected Products

VendorProductVersionsPlatforms
VMwarevers:unknown/*——

Aliases

CVE-2025-41252CVE-2025-41251CVE-2025-41250

Transitive aliases

VVD-CISA-2025-41251BDU:2025-12559GHSA-5vpj-22hp-chfgCNVD-2025-23111EUVD-2025-31600GHSA-2gr4-4mrg-85rhVVD-CISA-2025-41252VVD-CISA-2025-41250BDU:2025-12558CNVD-2025-23110EUVD-2025-31592CNVD-2025-23109BDU:2025-12560GHSA-5qfp-g44c-j8xmEUVD-2025-31599

References

advisory
advisory
advisory
advisory
advisory

Browse GCVE Records

100 records in the GCVE database · Updated April 16, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›