CVE-2025-26633

CVE-2025-26633 is a local-privilege-escalation in Microsoft Management Console (MMC) caused by improper neutralization in how MMC loads language-twin .msc files. A malicious “evil twin” .msc in a language directory can execute payloads with the user’s privileges when a user opens a legitimate MMC...

CVE-2025-26633 Microsoft Management Console Security Feature Bypass Vulnerability

...

CVE-2024-45328

An incorrect authorization vulnerability CWE-863 in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu...

CVE-2024-45328

FortiSandbox 4.4.0–4.4.6 contains an improper authorization vulnerability (CWE-863) that can let a low-privilege administrator execute elevated CLI commands via the GUI console menu. Affected component: FortiSandbox GUI/CLI integration (exact files/functions not detailed in the provided sources)....

CVE-2024-45328

An incorrect authorization vulnerability CWE-863 in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu...

Microsoft Management Console Security Feature Bypass Vulnerability

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally...

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-24983link is external Microsoft Windows Win32k Use-After-Free Vulnerability CVE-2025-24984link is external Microsoft Windows NTFS Information Disclosure...

CVE-2025-0062

SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impac...

CVE-2025-0062 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impac...

PT-2025-10772

Name of the Vulnerable Software and Affected Versions: FortiSandbox versions 4.4.0 through 4.4.6 Description: An incorrect authorization issue may allow a low-privileged administrator to execute elevated CLI commands via the GUI console menu. This could potentially lead to privilege escalation...

Microsoft Management Console security vulnerabilities

Microsoft Management Console is a general-purpose management console framework from Microsoft Corporation USA that hosts and manages a variety of system management tools called console plug-ins or management units. A security vulnerability exists in Microsoft Management Console. An attacker...

VulnCheck KEV: CVE-2025-26633

Microsoft Windows Management Console MMC contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally...

PT-2025-10848

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patch released in March 2025. Description A security feature bypass vulnerability exists in Microsoft Management Console MMC. This vulnerability, also known as MSC EvilTwin CVE-2025-26633, allows an...

CVE-2025-26633

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. Recent assessments: cbeek-r7 at March 26, 2025 11:31am UTC reported: CVE-2025-26633, nicknamed “MSC EvilTwin”, is a security feature bypass vulnerability in Microsoft...

CVE-2024-45328: Incorrect Authorization

An incorrect authorization vulnerability CWE-863 in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu...

RustDesk Console Default Credentials

RustDesk is a mote access and control software that enables management of computers and other devices. RustDesk server Pro embeds a web console allowing users to browse devices and perform configuration modification on the application. A remote and unauthenticated attacker can use the default...

RustDesk Console Detected

RustDesk is a mote access and control software that enables management of computers and other devices. RustDesk server Pro embeds a web console allowing users to browse devices and perform configuration modification on the application. By leveraging this, a remote and unauthenticated attacker cou...

Incorrect authorization in GUI console

...

CVE-2025-26633: Improper Neutralization

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally...

CVE-2025-0062: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impac...