CVE-2025-5450

Ivanti Connect Secure and Ivanti Policy Secure are affected by CVE-2025-5450 due to improper access control in the certificate management component. A remote authenticated admin with read-only rights can modify settings that should be restricted on versions prior to 22.7R2.8 (ICS) and 22.7R1.5 (I...

WordPress Sala theme <= 1.1.3 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Rau má đậu xanh in WordPress Theme Sala versions = 1.1.3...

CVE-2025-20998

Improper access control in SamsungAccount for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to access phone number...

PT-2025-28460 · Dell · Dell Client Platform Bios

Name of the Vulnerable Software and Affected Versions: Dell Client Platform BIOS affected versions not specified Description: The issue is related to an Improper Access Control Applied to Mirrored or Aliased Memory Regions vulnerability in an externally developed component. A high privileged...

WordPress Sala Theme <= 1.1.3 is vulnerable to Broken Access Control

Software Sala Type Theme Vulnerable versions = 1.1.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-52803 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 485a6b36a4e6 Credits Thái An Required privilege Unauthenticate...

CVE-2025-20324 Improper Access Control in System Source Types Configuration in Splunk Enterprise

In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite system source type configurations by...

CVE-2025-20324 Improper Access Control in System Source Types Configuration in Splunk Enterprise

In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite system source type configurations by...

CVE-2025-53501

Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Authorization.This issue affects Mediawiki - Scribunto Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before...

CVE-2025-3702

Missing Authorization vulnerability in Melapress Melapress File Monitor website-file-changes-monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress File Monitor: from n/a through 2.2.0...

USN-7591-5: Linux kernel (Intel IoTG) vulnerabilities

Michael Randrianantenaina discovered that the Bluetooth driver in the Linux Kernel contained an improper access control vulnerability. A nearby attacker could use this to connect a rougue device and possibly execute arbitrary code. CVE-2024-8805 It was discovered that the CIFS network file system...

CVE-2025-50032 WordPress Paytiko for WooCommerce <= 1.3.14 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Paytiko - Payment Orchestration Platform Paytiko for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Paytiko for WooCommerce: from n/a through 1.3.14...

OESA-2025-1732 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation in the United States. Apache Traffic Server ATS versions...

WordPress LMSACE Connect plugin <= 3.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin LMSACE Connect versions = 3.4...

CVE-2025-29001

Missing Authorization vulnerability in ZoomIt WooCommerce Shop Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7...

CVE-2025-30929 WordPress fluXtore plugin <= 1.6.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in amazewp fluXtore fluxtore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fluXtore: from n/a through = 1.6.0...

CVE-2025-30929 WordPress fluXtore plugin <= 1.6.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in amazewp fluXtore fluxtore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fluXtore: from n/a through = 1.6.0...

CVE-2025-29012 WordPress CF7 7 Mailchimp Add-on plugin < 2.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on CF7-mailchimp-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 7 Mailchimp Add-on: from n/a through 2.4...

PT-2025-27938 · Mobiloud · Mobiloud

Name of the Vulnerable Software and Affected Versions: MobiLoud versions n/a through 4.6.5 Description: The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For versions n/a through 4.6....

WordPress plugin DocCheck Login 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. An Access Control Error vulnerability exists in WordPress DocCheck Login, which originates from a page load that redirects a user to login, and can be exploited by an...

CVE-2025-3702

CVE-2025-3702 describes a Missing Authorization (broken access control) vulnerability in the WordPress Melapress File Monitor plugin, affecting versions prior to 2.2.0. Multiple sources consolidate the same issue. The root cause is improperly configured access control levels that can be exploited...