CVE-2025-14602

The CVSS 5.3 score for CVE-2025-14602 badly understates the real risk. This is a timestamp-based filename enumeration flaw in Visual Basic Desk's VSUpload component — attackers can predict upload filenames within a narrow time window and enumerate uploaded files. The 'short window' framing in the description is dangerous ambiguity: if the window is seconds, automated tools make precision guesses trivial; if it's minutes, enumeration is outright easy. More critically, the CVE describes brute-forcing unknown uploads, but the real exposure is retroactive — if an attacker knows when a file was uploaded (from logs, metadata, or simply their own upload history), they can access that file indefinitely regardless of patching. The patch at version 14.0101 claims to fix this, but verify the actual replacement algorithm: moving from timestamps to UUIDs solves nothing if the UUID is seeded from predictable state (session ID, user ID, sequential counter). The deeper failure is architectural — timestamp-based filename generation has recurred across web servers in the 2000s, CMS platforms in the 2010s, and now SaaS applications, each time treated as medium severity and each time resurfacing. The CVSS 5.3 rating itself perpetuates this cycle by signaling low urgency to patch systems, giving attackers a wider window to exploit enumeration chained with whatever sensitive data your upload endpoint handles. Treat this as exploitable immediately: restrict upload directory access at the web server level, implement authentication gates on any file retrieval, and verify your deployment doesn't leave historical uploads from the vulnerable period accessible. The EPSS score of 0.00275 measures exploit code complexity — but this attack is a for-loop, not an exploit.

Reviewed through automated stages and approved by a human before publication.