CVE-2025-12602

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

/etc/avahi/services/z9.service can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Nov 1, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-126039.8/etc/timezone can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-126049.8A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /load_fields.php.CVE-2025-126059.8A vulnerability was found in itsourcecode Online Loan Management System 1.0. This vulnerability affects unknown code of the file /manage_loaCVE-2025-126069.8A vulnerability was determined in itsourcecode Online Loan Management System 1.0. This issue affects some unknown processing of the file /maCVE-2025-126079.8A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Impacted is an unknown function of the file /manage_paymenCVE-2025-126089.8A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the fiCVE-2025-126098.8A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/upCVE-2025-12615.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's CouCVE-2025-126107.2A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.CVE-2025-126119.8A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetPCVE-2025-126129.8A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of thCVE-2025-126138.6Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values c
CVE-2025-12602: Critical severity, CVSS 9.8 | Vulnix