CVE-2025-63434

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control the update metadata can serve a malicious package, which the application will accept, extract, and later execute, leading to arbitrary code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-494

Affected software

No affected versions have been published.

Timeline

Published: Nov 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-634354.3Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible fo CVE-2025-63449.8A vulnerability has been found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this vulnerability is an unkno CVE-2025-634417.3Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/frien CVE-2025-634424.6Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section. The system fails to p CVE-2025-634435.4School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter.CVE-2025-634466.1Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php.CVE-2025-634476.1Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php.CVE-2025-634486.1Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1.CVE-2025-634495.4Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php.CVE-2025-63455.4A vulnerability was found in SourceCodester My Food Recipe 1.0 and classified as problematic. Affected by this issue is the function addReci CVE-2025-634505.4Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php.CVE-2025-634519.8Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php.