CVE-2025-30182

MediumCVSS 6.7/10Last modified Oct 19, 2026

Description

Uncontrolled search path for some Intel(R) Distribution for Python software installers before version 2025.2.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-301837.5CyberData 011209 Intercom does not properly store or protect web server admin credentials.CVE-2025-301849.8CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path.CVE-2025-301857.9Active debug code for some Intel UEFI reference platforms within Ring 0: Kernel may allow a denial of service and escalation of privilege. SCVE-2025-301865.4Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be exCVE-2025-301873.7In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might bCVE-2025-301887.5Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is requirCVE-2025-301897.4When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be usCVE-2025-30197.2KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opeCVE-2025-301905.4Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the cCVE-2025-301915.4Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensCVE-2025-301927.5An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. CVE-2025-301937.5In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client
CVE-2025-30182: Medium severity, CVSS 6.7 | Vulnix