CVE-2025-57227

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An unquoted service path in Kingosoft Technology Ltd Kingo ROOT v1.5.8.3353 allows attackers to escalate privileges via placing a crafted executable file into a parent folder.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published: Oct 29, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-57234.8A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unkn CVE-2025-572317.5Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request CVE-2025-57244.8A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been classified as problematic. Affected is an unkn CVE-2025-572406.1Cross site scripting (XSS) vulnerability in 17gz International Student service system 1.0 allows attackers to execute arbitrary code via the CVE-2025-572445.4OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field ac CVE-2025-572479.1The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorre CVE-2025-572487.3A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is CVE-2025-57254.8A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vuln CVE-2025-572546.5An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 allows remote attackers CVE-2025-57265.4A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been rated as problematic. Affected by this issue i CVE-2025-572637.2An authenticated SQL injection vulnerability in VX Guestbook 1.07 allows attackers with admin access to inject malicious SQL payloads via th CVE-2025-572669.8An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers t