CVE-2025-43715: Improper Check for Unusual or Exceptional Conditions

Nullsoft Scriptable Install System NSIS before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition...

CVE-2023-37378: Undefined Security Weakness

Nullsoft Scriptable Install System NSIS before 3.09 mishandles access control for an uninstaller directory...

CVE-2015-9267: Improper Privilege Management

Nullsoft Scriptable Install System NSIS before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program...

CVE-2015-9268: Improper Input Validation

Nullsoft Scriptable Install System NSIS before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime...