CVE-2025-9815

HighCVSS 7.8/10Last modified Sep 26, 2026

Description

A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file PrivilegeHelper/PrivilegeHelper.swift of the component NSXPCListener. This manipulation causes missing authentication. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-306

Affected software

Vendor	Product	Versions
alaneuler	batteryKid	2.0; 2.1

References

https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.mdExploit, Third Party Advisory
https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md#proof-of-conceptsExploit, Third Party Advisory
https://vuldb.com/?ctiid.322142Permissions Required, VDB Entry
https://vuldb.com/?id.322142Third Party Advisory, VDB Entry
https://vuldb.com/?submit.641358Third Party Advisory, VDB Entry
https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.mdExploit, Third Party Advisory
https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md#proof-of-conceptsExploit, Third Party Advisory

Timeline

Published: Sep 2, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-98167.2The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2025-98177.5SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service CVE-2025-98186.7A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLU CVE-2025-98204.0A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. W CVE-2025-98212.7SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request CVE-2025-98225.5SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally ava CVE-2025-98234.8SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s sessio CVE-2025-98245.9ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid u CVE-2025-98256.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that c CVE-2025-98265.4Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution f CVE-2025-98285.9A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing CVE-2025-98299.8A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /