CVE-2025-13663

MediumCVSS 6.7/10Last modified Oct 7, 2026

Description

Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the target installation directory already exists.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-279

Affected software

No affected versions have been published.

Timeline

Published
Dec 11, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-136646.7A potential security vulnerability in Quartus® Prime Standard Edition Design Software may allow escalation of privilege.CVE-2025-136656.7The System Console Utility for Windows is vulnerable to a DLL planting vulnerabilityCVE-2025-136665.3The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2. This is due to the plugiCVE-2025-136676.4The WP Recipe Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Skill Level' input field in all versions upCVE-2025-136686.7A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege.CVE-2025-136696.7Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hijacking.This issue aCVE-2025-13675.3A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprintCVE-2025-136706.7The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerabilityCVE-2025-136716.5Cross-Site Request Forgery (CSRF) vulnerability in OpenText™ Web Site Management Server allows Cross Site Request Forgery. The vulnerabilityCVE-2025-136725.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management SCVE-2025-136737.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in CVE-2025-136745.5BPv7 dissector crash in Wireshark 4.6.0 allows denial of service