CVE-2025-8284

CVE-2025-8284 affects Packet Power EMX and Packet Power EG’s Monitoring and Control Web Interface. The root cause is that the web interface by default does not enforce authentication, enabling unauthorized access to and manipulation of monitoring and control functions. The vulnerability is mapped...

@fedify/fedify has Improper Authentication and Incorrect Authorization

Summary An authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor...

CVE-2025-54607

Authentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-54987

A vulnerability in Trend Micro Apex One on-premise management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture...

CVE-2025-8616 Malicious browser plugins may cause Authentication replay attack vulnerability to bypass authentication in OpenText Advanced Authentication

A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process to bypass Authentication. This issue affects Advanced Authentication on or before 6.5.0...

CVE-2025-54607

Authentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-54607

Authentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-54607

The CVE-2025-54607 entry concerns Huawei HarmonyOS ArkWeb module authentication management. Connected sources corroborate that an authentication management issue exists in ArkWeb, with potential impact to service confidentiality upon successful exploitation. Affected component is ArkWeb within Ha...

Huawei HarmonyOS和Huawei EMUI 安全漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scene distributed operating system based on a microkernel.Huawei EMUI is an emotional operating system developed by Huawei based on Android Android. An incomplete authentication information vulnerability...

CVE-2025-51054

The Vedo Suite 2024.17 (an enterprise software suite for the textile and design industry by Bottinelli Informatica) is vulnerable to an Incorrect Access Control flaw. A remote attacker can obtain a valid high-privilege JWT token without prior authentication by sending an empty HTTP POST request t...

PT-2025-32195 · Aomei · Aomei Cyber Backup

Name of the Vulnerable Software and Affected Versions: AOMEI Cyber Backup affected versions not specified Description: AOMEI Cyber Backup suffers from a missing authentication flaw for a critical function, potentially leading to remote code execution. Recommendations: At the moment, there is no...

CVE-2025-6207 WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpietempalteimport' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2025-6207 WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpietempalteimport' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2025-54982

CVE-2025-54982 concerns Zscaler's SAML authentication where the server-side verification of cryptographic signatures is improper, enabling authentication abuse. Public records describe the vulnerability as a cryptographic signature validation weakness that could allow bypassing authentication con...

WordPress Brave Conversion Engine (PRO) plugin <= 0.7.7 - Authentication Bypass to Administrator vulnerability

Authentication Bypass to Administrator vulnerability discovered by Thái An in WordPress Plugin Brave Conversion Engine PRO versions = 0.7.7...

CVE-2025-8399 Mmm Unity Loader <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributes Parameter

The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

Improper Handling of Case Sensitivity

Overview github.com/hashicorp/vault/builtin/credential/ldap is a package ldap for Hashicorp. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the pathLoginAliasLookahead implementation. An attacker can gain unauthorized access and bypass authentication...

CVE-2025-6037

CVE-2025-6037: HashiCorp Vault and Vault Enterprise TLS certificate authentication failed to validate client certificates when configured with non-CA certificates as trusted, potentially allowing impersonation. Affected products: Vault Community Edition and Vault Enterprise; root cause: incorrect...

CVE-2019-19144

XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 11449-53631 Build304 devices via rest/Users?action=authenticate...

PT-2025-31644 · Quantum · Quantum Dxi6702

Name of the Vulnerable Software and Affected Versions: Quantum DXi6702 version 2.3.0.3 11449-53631 Build304 Description: An XML External Entity Injection issue exists in Quantum DXi6702 devices. The vulnerability is located in the /rest/Users?action=authenticate API endpoint. Recommendations: At...