CVE-2025-59470Critical· 9.0▾ AbyssalPoC availableThis vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 49.5 · likelihood 0.3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
1.6%
Last analysed / modified upstream
1 GitHub repo (last check)
This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.
veeam_backup_&_replication >= 13.0.0.4967, < 13.0.1.1071Upgrade past the affected range:
veeam_backup_&_replication 13.0.1.1071Connected by shared product, vendor, weakness, or advisory.
CVE-2025-55125High· 7.8This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file.
CVE-2025-59468Critical· 9.0This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.
CVE-2025-59469Critical· 9.0This vulnerability allows a Backup or Tape Operator to write files as root.
CVE-2025-48983Critical· 9.9A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.
CVE-2025-48984High· 8.8A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.
CVE-2025-14659High· 8.8A vulnerability was detected in D-Link DIR-860LB1 and DIR-868LB1 203b01/203b03