CVE-2025-5522

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in jack0240 魏 bskms 蓝天幼儿园管理系统 up to dffe6640b5b54d8e29da6f060e0493fea74b3fad. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sa/addUser of the component User Creation Handler. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266 CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Jun 3, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-552217.5A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 CVE-2025-552227.5A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 CVE-2025-552237.0Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker CVE-2025-552247.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized at CVE-2025-552256.5Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a networ CVE-2025-552266.7Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker CVE-2025-552278.8Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate p CVE-2025-552287.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized at CVE-2025-552295.3Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network.CVE-2025-55236.1A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file sr CVE-2025-552307.8Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally.CVE-2025-552317.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an unauthorized attack