CVE-2025-27440

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-124

Affected software

No affected versions have been published.

Timeline

Published
Mar 11, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-274415.2Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network accesCVE-2025-274425.2Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network accesCVE-2025-274435.5Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrCVE-2025-274444.8A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling CVE-2025-274455.4A path traversal vulnerability in RSFirewall component 2.9.7 - 3.1.5 for Joomla was discovered. This vulnerability allows authenticated userCVE-2025-274467.8Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions CVE-2025-274476.1The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code intCVE-2025-274485.4The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code intCVE-2025-274499.8The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, makiCVE-2025-27456.5A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticatedCVE-2025-274506.5The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to establish an unencryptedCVE-2025-274515.3For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect passwo
CVE-2025-27440: High severity, CVSS 8.8 | Vulnix