{"id":"CVE-2025-55076","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-55076","generatedAt":"2026-10-27T23:58:38.334Z","title":"A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 for macOS.","description":"A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 for macOS. The service accepts unauthenticated XPC connections and executes input via system(), which may allow a local user to execute arbitrary commands with root privileges.","published":"2025-12-03T17:15:52.000Z","lastModified":"2026-10-26T22:10:00.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":6.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-269"],"affected":["plugin-alliance/installation manager"],"epss":{"score":0.0021,"percentile":0.11069,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://almightysec.com/plugin-alliance-helpertool-xpc-service-local-privilege-escalation/","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-55076","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}