CVE-2024-25081

MediumCVSS 4.2/10Last modified Jun 17, 2026

Description

Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Feb 26, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-250826.5Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.CVE-2024-250837.8An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low-privileged user initiates a repair, there iCVE-2024-250867.8Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execute arbitrary code.CVE-2024-250875.5Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.7.0 allows local attackers to cause a Windows blue screen error.CVE-2024-250887.8Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execute arbitrary code.CVE-2024-250899.8Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes.CVE-2024-25096.5The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputtiCVE-2024-250905.4Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all verCVE-2024-250919.1Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' featCVE-2024-250928.8Missing Authorization vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.17.0.CVE-2024-250936.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Rating System allowsCVE-2024-250945.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Jura & Nicolas Montigny PJ News T
CVE-2024-25081: Medium severity, CVSS 4.2 | Vulnix