CVE-2025-13152

HighCVSS 7.8/10Last modified Sep 25, 2026

Description

A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local authenticated user to execute code with elevated privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Dec 10, 2025
Last modified: Sep 25, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-131536.1The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the da CVE-2025-131545.5An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated loca CVE-2025-131557.8An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with CVE-2025-131568.8The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type vali CVE-2025-131575.3The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin CVE-2025-131589.3Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript obj CVE-2025-131597.1The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all CVE-2025-13169.8Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on CVE-2025-131605.3IQ-Support developed by IQ Service International has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote atta CVE-2025-131617.5IQ-Support developed by IQ Service International has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to expl CVE-2025-131624.4Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affects Control Builder A:CVE-2025-131634.9EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain p