CVE-2025-12047

MediumCVSS 5.3/10Last modified Oct 18, 2026

Description

A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an attacker on the same logical network to disclose sensitive user files from the application.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-120487.5An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow CVE-2025-120499.8Missing Authentication for Critical Function vulnerability in Sharp Display Solutions Media Player MP-01 All Verisons allows a attacker may CVE-2025-120507.8The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may CVE-2025-120517.8The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may CVE-2025-120527.8The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may CVE-2025-120537.8The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may CVE-2025-120557.5HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Ma CVE-2025-120568.3Out-of-bounds Read in Shelly Pro 3EM (before v1.4.4) allows Overread Buffers.CVE-2025-120579.8The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copie CVE-2025-120585.9The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is vulnerable to arbitrary CVE-2025-120599.8Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Logo Software Industry and Trade Inc. Logo CVE-2025-12068.8A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the fil