CVE-2025-32327

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In multiple functions of PickerDbFacade.java, there is a possible unauthorized data access due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-323287.8In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic errCVE-2025-323297.8In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic errCVE-2025-323305.7In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio stream due to an insecuCVE-2025-323317.8In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This couCVE-2025-323327.8In multiple locations, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with CVE-2025-323337.8In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to a logic error in the code. This could lCVE-2025-32347.2The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versCVE-2025-323457.8In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary userCVE-2025-323467.8In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. This cCVE-2025-323477.8In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. TCVE-2025-323487.8In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalationCVE-2025-323497.8In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to local escalation of p
CVE-2025-32327: High severity, CVSS 7.8 | Vulnix