Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-32297 State: PUBLISHED Published: 2025-07-04T11:18:06.614Z Last Updated: 2025-07-07T14:59:16.616Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: quantumcloud Products: Simple Link Directory Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Link Directory allows SQL Injection. This issue affects Simple Link Directory: from n/a through 14.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-pro-plugin-14-
tack.com/database/wordpress/plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-pro-plugin-14-7-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-32298 State: PUBLISHED Published: 2025-06-27T11:52:36.269Z Last Updated: 2025-06-27T14:07:23.947Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Case-Themes Products: CTUsers Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case-Themes CTUsers allows PHP Local File Inclusion. This issue affects CTUsers: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ctuser/vulnerability/wordpress-ctusers-1-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-32299 State: PUBLISHED Published: 2025-05-16T15:45:30.411Z Last Updated: 2025-05-16T16:46:38.701Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Themovation Products: QuickCal Problem Types: CWE-497 Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal allows Retrieve Embedded Sensitive Data. This issue affects QuickCal: from n/a through 1.0.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/quickcal/vulnerability/wordpress-quickcal-1-0-15-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-32301 State: PUBLISHED Published: 2025-05-16T15:45:29.883Z Last Updated: 2025-05-16T16:46:46.527Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: LambertGroup Products: CountDown Pro WP Plugin Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown Pro WP Plugin allows SQL Injection. This issue affects CountDown Pro WP Plugin: from n/a through 2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/circular_countdown/vulnerability/wordpress-countdown-pro-wp-plugin-2-7-sql-injecti
chstack.com/database/wordpress/plugin/circular_countdown/vulnerability/wordpress-countdown-pro-wp-plugin-2-7-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-32302 State: PUBLISHED Published: 2025-05-23T12:43:56.808Z Last Updated: 2025-05-23T13:39:46.501Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: gavias Products: Winnex Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Winnex allows PHP Local File Inclusion. This issue affects Winnex: from n/a through 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/winnex/vulnerability/wordpress-winnex-1-3-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-32305 State: PUBLISHED Published: 2025-06-09T15:54:18.184Z Last Updated: 2025-06-09T16:03:37.756Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Sneeit Products: FlatNews Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit FlatNews allows Reflected XSS. This issue affects FlatNews: from n/a through 5.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/flatnews/vulnerability/wordpress-flatnews-theme-5-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-32306 State: PUBLISHED Published: 2025-05-16T15:45:29.365Z Last Updated: 2025-05-16T16:46:52.980Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: LambertGroup Products: Radio Player Shoutcast & Icecast WordPress Plugin Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin allows Blind SQL Injection. This issue affects Radio Player Shoutcast & Icecast WordPress Plugin: from n/a through 4.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plu
gh 4.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/audio4-html5/vulnerability/wordpress-radio-player-shoutcast-icecast-wordpress-plugin-4-4-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-32307 State: PUBLISHED Published: 2025-05-16T15:45:28.801Z Last Updated: 2025-05-16T16:47:31.791Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: LambertGroup Products: Chameleon HTML5 Audio Player With/Without Playlist Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Chameleon HTML5 Audio Player With/Without Playlist allows SQL Injection. This issue affects Chameleon HTML5 Audio Player With/Without Playlist: from n/a through 3.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin
3.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg-audio1-html5/vulnerability/wordpress-chameleon-html5-audio-player-with-without-playlist-3-5-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-32308 State: PUBLISHED Published: 2025-06-09T15:54:17.431Z Last Updated: 2025-06-10T13:36:34.369Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: looks_awesome Products: Team Builder Problem Types: CWE-862 Description: Missing Authorization vulnerability in looks_awesome Team Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Team Builder: from n/a through 1.5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/a-team-showcase/vulnerability/wordpress-team-builder-1-5-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-32309 State: PUBLISHED Published: 2025-05-23T12:43:56.345Z Last Updated: 2025-05-23T13:40:11.018Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeMove Products: Healsoul Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Healsoul allows PHP Local File Inclusion. This issue affects Healsoul: from n/a through 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/healsoul/vulnerability/wordpress-healsoul-2-0-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-32310 State: PUBLISHED Published: 2025-05-16T15:45:28.252Z Last Updated: 2025-05-16T16:47:38.442Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ThemeMove Products: QuickCal Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeMove QuickCal allows Privilege Escalation. This issue affects QuickCal: from n/a through 1.0.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/quickcal/vulnerability/wordpress-quickcal-plugin-1-0-13-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-32311 State: PUBLISHED Published: 2025-07-04T11:18:06.106Z Last Updated: 2025-07-07T14:59:24.611Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: QuanticaLabs Products: Pressroom - News Magazine WordPress Theme Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Pressroom - News Magazine WordPress Theme allows Reflected XSS. This issue affects Pressroom - News Magazine WordPress Theme: from n/a through 6.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/pressroom/vulnerability/wordp
es: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/pressroom/vulnerability/wordpress-pressroom-news-magazine-wordpress-theme-theme-6-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-32312 State: PUBLISHED Published: 2025-09-04T17:15:08.208Z Last Updated: 2025-09-06T03:55:54.122Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/577cdba1048ce04816c962264a11efd02f1f5b73
ment: References: - https://android.googlesource.com/platform/frameworks/base/+/577cdba1048ce04816c962264a11efd02f1f5b73 - https://source.android.com/security/bulletin/2025-06-01
CVE ID: CVE-2025-32316 State: PUBLISHED Published: 2025-09-05T16:10:04.806Z Last Updated: 2025-09-05T16:44:02.720Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In gralloc4, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/android-16
CVE ID: CVE-2025-32317 State: PUBLISHED Published: 2025-09-05T16:10:06.002Z Last Updated: 2025-09-05T16:43:02.650Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In App Widget, there is a possible Information Disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/android-16
CVE ID: CVE-2025-32318 State: PUBLISHED Published: 2025-09-05T16:10:07.061Z Last Updated: 2025-09-06T03:56:15.887Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In Skia, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/android-16
CVE ID: CVE-2025-32320 State: PUBLISHED Published: 2025-09-05T16:10:08.196Z Last Updated: 2025-09-06T03:56:15.106Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In System UI, there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/android-16
CVE ID: CVE-2025-32321 State: PUBLISHED Published: 2025-09-04T18:33:49.472Z Last Updated: 2025-09-06T03:55:57.836Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/bb6e84fd04fcc3594750645982f8c667b0cd8c5e - https://source.android.com/security/bulletin/
atform/packages/apps/Settings/+/bb6e84fd04fcc3594750645982f8c667b0cd8c5e - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32322 State: PUBLISHED Published: 2025-09-04T19:39:27.026Z Last Updated: 2025-09-04T20:02:46.048Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onCreate of MediaProjectionPermissionActivity.java , there is a possible way to grant a malicious app a token enabling unauthorized screen recording capabilities due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/wear/2025-09-01
CVE ID: CVE-2025-32323 State: PUBLISHED Published: 2025-09-04T18:33:50.501Z Last Updated: 2025-09-05T17:17:40.011Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In getCallingAppName of Shared.java, there is a possible way to trick users into granting file access via deceptive text in a permission popup due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/f0336ada165fdda955eaf6245b501779f36f0bd3 -
nces: - https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/f0336ada165fdda955eaf6245b501779f36f0bd3 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32324 State: PUBLISHED Published: 2025-09-04T18:33:51.515Z Last Updated: 2025-09-06T03:55:58.594Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/0fb2788dac393086b7e53fbe05414368ae395d9b - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32325 State: PUBLISHED Published: 2025-09-04T18:33:52.544Z Last Updated: 2025-09-06T03:55:59.367Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/native/+/96f0dd71bc07051e4faae44abf7121a3f7b5b2aa - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32326 State: PUBLISHED Published: 2025-09-04T18:33:53.562Z Last Updated: 2025-09-06T03:56:00.166Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/e8a17485771e54124abc08e8fb6c987bf83726a2 - https://source.android.com/security/bulletin/2
tform/packages/apps/Settings/+/e8a17485771e54124abc08e8fb6c987bf83726a2 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32327 State: PUBLISHED Published: 2025-09-04T18:33:54.594Z Last Updated: 2025-09-06T03:56:00.917Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple functions of PickerDbFacade.java, there is a possible unauthorized data access due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/providers/MediaProvider/+/3f48b77e7cb9c15a76d42cfe4b2c771611625f9c - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32330 State: PUBLISHED Published: 2025-09-04T18:33:55.600Z Last Updated: 2025-09-05T17:19:32.423Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio stream due to an insecure default value. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/5b10581d2a91ddb256a1e37efcbcdb015091f5a1 - https://
ences: - https://android.googlesource.com/platform/frameworks/base/+/5b10581d2a91ddb256a1e37efcbcdb015091f5a1 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32331 State: PUBLISHED Published: 2025-09-04T18:33:56.600Z Last Updated: 2025-09-06T03:56:01.841Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/7f5cc94e82fca9b758c46c97d6be9cc38ef07208 - https://source.android.com/security/bulletin/2025-09-0
form/frameworks/base/+/7f5cc94e82fca9b758c46c97d6be9cc38ef07208 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32332 State: PUBLISHED Published: 2025-09-04T18:33:57.653Z Last Updated: 2025-09-06T03:56:03.281Z Vendors: Google Products: Android Problem Types: Unknown Description: In multiple locations, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32333 State: PUBLISHED Published: 2025-09-04T18:33:58.672Z Last Updated: 2025-09-06T03:56:16.660Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/591ea09a63e577a9ed666006e70430cc4f245078 - https://source.android.com/security/bulletin/2025-0
/packages/apps/Settings/+/591ea09a63e577a9ed666006e70430cc4f245078 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32345 State: PUBLISHED Published: 2025-09-04T18:33:59.684Z Last Updated: 2025-09-06T03:56:05.902Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app scanning setting due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/6c9a5944dd0458
- CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/6c9a5944dd0458b90263da2e4a4ba618c69779dd - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32346 State: PUBLISHED Published: 2025-09-04T18:34:00.694Z Last Updated: 2025-09-06T03:56:06.700Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32347 State: PUBLISHED Published: 2025-09-04T18:34:01.756Z Last Updated: 2025-09-06T03:56:07.508Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/25cfacbe5ac2423b8fe1375e0593ef69e98b8d09 - https://source.android.com/security/bulletin
latform/packages/apps/Settings/+/25cfacbe5ac2423b8fe1375e0593ef69e98b8d09 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32349 State: PUBLISHED Published: 2025-09-04T18:34:02.796Z Last Updated: 2025-09-06T03:56:09.147Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/e4a93e6ffdaf0e51c2effd26a222a4e0b66ea5cb - https://android.googlesource.com/platform/frameworks/base/+/394acf2aa1dade06c9cb2b98d9
daf0e51c2effd26a222a4e0b66ea5cb - https://android.googlesource.com/platform/frameworks/base/+/394acf2aa1dade06c9cb2b98d92d6e585de31012 - https://source.android.com/security/bulletin/2025-09-01