CVE-2025-15556
HIGH KEVNotepad++ < 8.8.9 - Download of Code Without Integrity Check in WinGUp Updater
Title source: llmExploitation Summary
CVE-2025-15556 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 12, 2026. EIP tracks 3 public exploits from researchers including XiaomingX, George0Papasotiriou, renat0z3r0.
AI-analyzed exploit summary The repository contains a functional SQL injection exploit for CVE-2025-10042, targeting WordPress Quiz Maker plugin versions <= 6.7.0.56. The exploit uses time-based blind SQLi to extract admin credentials and hashes.
Description
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
Exploits (3)
The repository contains a functional SQL injection exploit for CVE-2025-10042, targeting WordPress Quiz Maker plugin versions <= 6.7.0.56. The exploit uses time-based blind SQLi to extract admin credentials and hashes.
This PoC demonstrates a man-in-the-middle attack against Notepad++'s WinGUp updater by serving a malicious update.xml file that bypasses integrity checks, leading to arbitrary code execution. The exploit includes a Python-based MITM proxy and a DNS spoofing simulation script.
This repository is a comprehensive writeup and IoC collection for CVE-2025-15556, detailing a supply chain attack on Notepad++ via its WinGUp updater. It includes infection chains, detection methods, and threat hunting queries but does not contain exploit code.
References (7)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H