CVE-2025-5494

HighCVSS 7.8/10Last modified Oct 11, 2026

Description

ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup.

This issue affects Endpoint Central: through 11.4.2500.25, through 11.4.2508.13.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Sep 25, 2025
Last modified
Oct 11, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-549404.6An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafCVE-2025-549414.6An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server anCVE-2025-549429.8A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attacCVE-2025-549439.8A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthoCVE-2025-549449.8An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote aCVE-2025-549459.8An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers tCVE-2025-549469.8A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL cCVE-2025-549479.8In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerabilityCVE-2025-549489.8A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious CVE-2025-549499.8A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effecCVE-2025-54959.8A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the componCVE-2025-549509.8An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code exec
CVE-2025-5494: High severity, CVSS 7.8 | Vulnix