CVE-2025-55699

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-55705.4The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versionCVE-2025-557004.3Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a networCVE-2025-557017.8Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally.CVE-2025-557028.7When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unreadCVE-2025-557033.3An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint thCVE-2025-557045.3Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of tCVE-2025-557059.8This vulnerability occurs when the system permits multiple simultaneous connections to the backend using the same charging station ID. ThisCVE-2025-557065.1URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter CVE-2025-557077.2Incorrect Privilege Assignment vulnerability in WPXPO PostX ultimate-post allows Privilege Escalation.This issue affects PostX: from n/a thrCVE-2025-557088.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey MaCVE-2025-557096.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer WebsitCVE-2025-55718.8A vulnerability was found in D-Link DCS-932L 2.18.01. It has been classified as critical. Affected is the function setSystemAdmin of the fil
CVE-2025-55699: Medium severity, CVSS 5.5 | Vulnix