CVE-2025-25500

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Mar 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-255046.5An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with netwo CVE-2025-255056.5Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the sub_452A4 function.CVE-2025-255076.5There is a RCE vulnerability in Tenda AC6 15.03.05.16_multi. In the formexeCommand function, the parameter cmdinput will cause remote comman CVE-2025-25514.3A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been classified as problematic. This affects an unknown part of t CVE-2025-255106.5Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the get_parentControl_list_Info function.CVE-2025-255139.8Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.CVE-2025-255146.5Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.CVE-2025-255158.8Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.CVE-2025-255169.8Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.CVE-2025-255179.8Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.CVE-2025-255199.8Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.CVE-2025-25524.3A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been declared as problematic. This vulnerability affects unknown