PT-2025-20940 · Microsoft · Defender For Identity

Name of the Vulnerable Software and Affected Versions: Microsoft Defender for Identity affected versions not specified Description: The issue is related to improper authentication in Microsoft Defender for Identity, allowing an unauthorized attacker to perform spoofing over an adjacent network...

CVE-2025-3659 Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAP

Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: Digi PortServer TS - prior to and including 82000747AA, build date 06/17/2022 Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774Z, build date 10/19/2020...

ZONG YU Parking Management System 安全漏洞

ZONG YU Parking Management System is a comprehensive intelligent parking management platform from China's ZONG YU company. A security vulnerability exists in the ZONG YU Parking Management System that stems from a lack of authentication in a specific API, which could lead to unauthenticated remot...

PT-2025-20739

Name of the Vulnerable Software and Affected Versions Digi PortServer TS versions prior to and including 82000747 AA, build date 06/17/2022 Digi One SP/Digi One SP IA/Digi One IA versions prior to and including 82000774 Z, build date 10/19/2020 Digi One IAP versions prior to and including 8200077...

CVE-2025-4494 JAdmin-JAVA JAdmin Admin Backend NoNeedLoginController.java toLogin improper authentication

A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0. Affected is the function toLogin of the file NoNeedLoginController.java of the component Admin Backend. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The...

CVE-2025-3949 Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.18.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'seedprodlitegetrevisisons' function in all versions up to, and including, 6.18.15...

CVE-2025-3506

The CVE-2025-3506 issue affects Checkmk deployments where files to be deployed with agents are accessible without authentication, affecting Checkmk versions 2.1.0, 2.2.0, 2.3.0 and all builds prior to 2.4.0b6. The root cause described across sources is unauthenticated access to agent-deployment f...

CVE-2025-41450

The Danfoss AK-SM8xxA Series refrigeration controllers are vulnerable to an improper authentication flaw (CVE-2025-41450) in versions prior to 4.2 . The root cause is a hidden "code-of-the-day" authentication bypass on the xml.cgi?action=getauth endpoint, where the password is derived from the de...

CVE-2025-45843

TOTOLINK NR1800X V9.1.0u.6681B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiGuestCfg function...

PT-2025-20393 · Totolink · Totolink Nr1800X

Name of the Vulnerable Software and Affected Versions: TOTOLINK NR1800X version 9.1.0u.6681 B20230703 Description: The issue is an authenticated stack overflow that occurs via the ssid parameter in the setWiFiBasicCfg function. This allows for potential exploitation. No information is provided...

CVE-2025-20194

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this...

CVE-2025-3851 Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposure

The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

CVE-2025-3218

The CVE-2025-3218 entry pertains to IBM i Netserver: IBM i versions 7.2–7.6 are vulnerable to authentication and authorization attacks due to incorrect validation processing in Netserver. The root cause is improper validation handling, enabling a malicious actor to bypass authority restrictions o...

PT-2025-20298 · Insa-Auth · Insa-Auth

Name of the Vulnerable Software and Affected Versions: insa-auth affected versions not specified Description: The issue concerns an authentication server for INSA Rouen, where a minor problem allowed third-party websites to access the server's secondary authentication bridge. This could potential...

Passport-wsfed-saml2 allows SAML Authentication Bypass via Attribute Smuggling

Overview This vulnerability allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done by adding attributes to the response. Am I Affected? You are affected by this SAML Attribute Smuggling vulnerability if you are using...

CVE-2025-46815

The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id...

CVE-2025-46584

Vulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

Exploit for Unrestricted Upload of File with Dangerous Type in Emagicone Emagicone_Store_Manager_For_Woocommerce

eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdis...

CVE-2025-25504

An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC In AV over IP products v1.85h, v1.86v, and v1.70 allows attackers with network access to connect to the device over TCP port 4444 without authentication and execute arbitrary commands with root privileges...

Langflow Missing Authentication Vulnerability

Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests...