CVE-2025-31645

MediumCVSS 6.7/10Last modified Oct 19, 2026

Description

Uncontrolled search path for some System Event Log Viewer Utility software for all versions within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-316476.7Uncontrolled search path for some Intel(R) Graphics Software before version 25.22.1502.2 within Ring 3: User Applications may allow an escalCVE-2025-316483.9Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. Startup code and CVE-2025-316498.7A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell CVE-2025-31655.3A vulnerability classified as critical has been found in thu-pacman chitu 0.1.0. This affects the function torch.load of the file chitu/chitCVE-2025-316507.5Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incompCVE-2025-316519.8Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurCVE-2025-316545.3An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").CVE-2025-316556.7Incorrect default permissions for some Intel(R) Battery Life Diagnostic Tool within Ring 3: User Applications may allow an escalation of priCVE-2025-31667.8A vulnerability classified as critical was found in code-projects Product Management System 1.0. This vulnerability affects the function seaCVE-2025-31677.5A vulnerability, which was classified as problematic, has been found in Tenda AC23 16.03.07.52. This issue affects some unknown processing oCVE-2025-316725.3Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These fCVE-2025-316734.6Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.
CVE-2025-31645: Medium severity, CVSS 6.7 | Vulnix