CVE-2025-13818

MediumCVSS 6.7/10Last modified Sep 3, 2026

Description

Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

No affected versions have been published.

Timeline

Published
Feb 6, 2026
Last modified
Sep 3, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-138196.1Open redirect in the web server component of MiR Robot and Fleet software allows a remote attacker to redirect users to arbitrary external wCVE-2025-13826.1The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as esCVE-2025-138205.3The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attaCVE-2025-138215.7Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allowCVE-2025-138225.3MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowCVE-2025-138237.1A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packeCVE-2025-138248.7A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red CVE-2025-138268.2Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is causeCVE-2025-138278.8Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf tCVE-2025-138289.0SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in updaCVE-2025-138298.6Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any CVE-2025-13834.3The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2.