CVE-2025-55671

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.

Metrics

CVSS 4.0 8.5/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Sep 5, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-556725.4A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to CVE-2025-556734.3When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload.CVE-2025-556746.5A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker CVE-2025-556756.5Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenti CVE-2025-556765.5Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose informati CVE-2025-556777.8Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.CVE-2025-556787.0Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.CVE-2025-556794.7Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally.CVE-2025-55685.4The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including CVE-2025-556807.0Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privile CVE-2025-556817.8Out-of-bounds read in Windows DWM allows an authorized attacker to elevate privileges locally.CVE-2025-556824.6Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physica