CVE-2025-64729

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and escalate their privileges to the identity of a victim user who subsequently interacts with the project files.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jan 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-64736.1A vulnerability, which was classified as problematic, was found in code-projects School Fees Payment System 1.0. This affects an unknown parCVE-2025-647306.1Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary script may be executeCVE-2025-647337.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-647342.4Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to peCVE-2025-647357.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-647367.1An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (5462afbCVE-2025-647385.5External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosCVE-2025-647397.5External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via nCVE-2025-64749.8A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknoCVE-2025-647407.8Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user CVE-2025-647419.8Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalatiCVE-2025-647443.5OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with