CVE-2025-39246

MediumCVSS 5.3/10Last modified Oct 18, 2026

Description

There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published: Aug 29, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-392478.6There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the ad CVE-2025-39257.8BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 contain an execution with unnecessary p CVE-2025-39279.8Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address CVE-2025-39288.8Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault CVE-2025-39296.1An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message w CVE-2025-39306.3Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an atta CVE-2025-39317.8A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes t CVE-2025-39326.5It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird au CVE-2025-39335.3A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within th CVE-2025-393489.8Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Gr CVE-2025-393499.8Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop ciyashop allows Object Injection.This issue affects CiyaS CVE-2025-39357.2ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState