CVE-2025-54081Medium· 6.7▾ SunlitSunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.
sunshine >= 0.10.0, < 2025.923.33222Upgrade past the affected range:
sunshine 2025.923.33222Connected by shared product, vendor, weakness, or advisory.
CVE-2025-43993High· 7.8Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or Element vulnerability
CVE-2025-61871Medium· 6.7NAS Navigator2 Windows version by BUFFALO INC
CVE-2025-12247High· 7.0A weakness has been identified in Hasleo Backup Suite up to 5.2
CVE-2025-12507High· 8.8The service Bizerba Communication Server (BCS) has an unquoted service path
CVE-2025-66461Medium· 6.7FULLBACK Manager Pro provided by GS Yuasa International Ltd
CVE-2019-25261High· 7.8AnyDesk 5.4.0 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially inject malicious executables