CVE-2025-47469 WordPress Media Hygiene plugin <= 4.0.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Hygiene: from n/a through = 4.0.0...

CVE-2025-47467

CVE-2025-47467 relates to a Missing Authorization vulnerability in WordPress GS Testimonial Slider (GS Testimonial Slider

CVE-2025-47465 WordPress Blocksy <= 2.0.97 - Broken Access Control Vulnerability

Missing Authorization vulnerability in CreativeThemes Blocksy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Blocksy: from n/a through 2.0.97...

WordPress Graphina plugin <= 3.0.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Anhchangmutrang in WordPress Plugin Graphina versions = 3.0.4...

WordPress Envo Extra plugin <= 1.9.9 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin Envo Extra versions = 1.9.9...

CVE-2025-20966

Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows physical attackers to access data across multiple user profiles...

CVE-2025-20970

Improper access control in Bixby Vision prior to version 3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15 allows local attackers to access image files with Bixby Vision privilege...

PT-2025-20231 · Unknown · Contentstudio

Name of the Vulnerable Software and Affected Versions: ContentStudio versions 1.3.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: For ContentStudio...

WordPress Login Lockdown & Protection plugin <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary IP Whitelisting vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Login Lockdown versions = 2.11...

CVE-2025-45617

Incorrect access control in the component /user/list of productionssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload...

CVE-2025-4269 TOTOLINK A720R Log cstecgi.cgi access control

A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The manipulation of the argument topicurl with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog...

PT-2025-19776 · Xinguan · Xinguan

Name of the Vulnerable Software and Affected Versions: Xinguan version 0.0.1-SNAPSHOT Description: The issue is related to incorrect access control in the "/system/user/findUserList" API endpoint, which allows attackers to access sensitive information by sending a crafted payload. Recommendations...

CVE-2025-45237

Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive account information, including the encrypted password...

PT-2025-18704 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue is related to inadequate access controls in the web management portal, allowing an unauthenticated remote attacker to enable ate, a remote system management binary, by sending a...

CVE-2025-46552

KHC-INVITATION-AUTOMATION (GitHub script) has a vulnerability in version 1.2 where API responses could expose user data (email addresses, Discord usernames) due to missing access controls. The issue was identified in certain commits and has been patched in a later commit of version 1.2. No exploi...

PT-2025-18167 · Unknown · Scriptandtools Online-Travling-System

Name of the Vulnerable Software and Affected Versions: ScriptAndTools Online-Travling-System version 1.0 Description: A critical issue has been identified, affecting the /admin/addadvertisement.php file, which leads to improper access controls. The issue can be exploited remotely. Recommendations...

CVE-2025-39367 WordPress Kleo theme < 5.4.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in SeventhQueen Kleo kleo.This issue affects Kleo: from n/a through 5.4.4...

CVE-2025-46576

There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to bypass privilege restrictions and delete content...

CVE-2025-28059

An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. When an administrator deletes a user account, the backend fails to terminate active sessions and revoke...

CVE-2025-27310

Missing Authorization vulnerability in Radius of Thought Page and Post Lister page-and-post-lister allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page and Post Lister: from n/a through = 1.2.1...