CVE-2019-25344

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executable files in the application directory. Attackers can replace the original MobileGo.exe with a malicious executable to create a new user account and add it to the Administrators group with full system access.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

VendorProductVersions
WondershareMobileGo8.5.0

References

Timeline

Published
Feb 12, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-253457.8Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute aCVE-2019-253467.5TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameCVE-2019-253477.5thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parametCVE-2019-253497.5ScadaApp for iOS 1.1.4.0 contains a denial of service vulnerability that allows attackers to crash the application by inputting an oversizedCVE-2019-25354.1Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 8.0.13CVE-2019-253507.5XMedia Recode 3.4.8.6 contains a denial of service vulnerability that allows attackers to crash the application by loading a specially craftCVE-2019-253518.8Centova Cast 3.2.11 contains a file download vulnerability that allows authenticated attackers to retrieve arbitrary system files through thCVE-2019-253527.5Crystal Live HTTP Server 6.01 contains a directory traversal vulnerability that allows remote attackers to access system files by manipulatiCVE-2019-253537.5Foscam Video Management System 1.1.4.9 contains a denial of service vulnerability in the username input field that allows attackers to crashCVE-2019-253547.5iSmartViewPro 1.3.34 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the camera ID CVE-2019-253557.5gSOAP 2.8 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTP patCVE-2019-253566.1Bematech (formerly Logic Controls, now Elgin) MP-4200 TH printer contains a cross-site scripting vulnerability in the admin configuration pa
CVE-2019-25344: High severity, CVSS 7.8 | Vulnix