CVE-2025-50691

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

MCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is stored in the data directory, readable by all users. Other users on the system can read the daemon's key and use it to log in, leading to privilege escalation.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-506929.8FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.CVE-2025-506936.5PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Insecure Direct Object Reference (IDOR) in odms/request-details.php.CVE-2025-506956.1PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in /admin/view-booking-detail.php and /admin/CVE-2025-506996.1PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in odms/admin/view-user-queries.php.CVE-2025-507069.8An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function CVE-2025-507079.8An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component CVE-2025-507087.5An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat CVE-2025-507094.3An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter CVE-2025-50718.8The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on CVE-2025-50725.3Resource leak vulnerability in ASR180x、ASR190x in con_mgr allows Resource Leak Exposure.This issue affects Falcon_Linux、Kestrel、Lapwing_Linu CVE-2025-507229.8Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via the Common.php component CVE-2025-50739.8A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. This issue affects some unknown processing of