CVE-2026-25865

HighCVSS 7.8/10Last modified Jun 23, 2026

Description

Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll Control_RunDLL input.dll. Attackers can place a malicious executable earlier in the search order to achieve arbitrary code execution in the context of the affected user.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published
Jun 18, 2026
Last modified
Jun 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-258667.8MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute NotepadCVE-2026-258686.1MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The apCVE-2026-258697.5MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter. The application appends useCVE-2026-25879.6A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gaCVE-2026-258705.8DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fetch functionality. TCVE-2026-258725.3JUNG Smart Panel KNX firmware version L1.12.22 and prior contain an unauthenticated path traversal vulnerability in the embedded web interfaCVE-2026-258739.8OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to eCVE-2026-258749.8LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserCVE-2026-258759.8PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts CVE-2026-258769.1PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts vCVE-2026-258776.5Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to versCVE-2026-258785.3FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware