CVE-2025-2501

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

No affected versions have been published.

Timeline

Published
May 30, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-250106.5Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability toCVE-2025-250117.0An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulneCVE-2025-250125.4URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forCVE-2025-250136.5Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens viCVE-2025-250149.8A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting CVE-2025-250159.9Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana CVE-2025-250164.3Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file dCVE-2025-250176.1Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)CVE-2025-250185.4Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)CVE-2025-250196.5IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session aCVE-2025-25027.8An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.CVE-2025-250206.5IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated
CVE-2025-2501: High severity, CVSS 7.8 | Vulnix