Lucene search
+L

3292 matches found

Cvelist
Cvelist
added 2025/12/24 1:10 p.m.38 views

CVE-2025-68593 WordPress WP Adminify plugin <= 4.0.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through = 4.0.6.1...

5.4CVSS0.00248EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2025/12/24 12:31 p.m.43 views

CVE-2025-68521 WordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through = 4.9.5...

5.3CVSS0.00218EPSS
SaveExploits0References1
CVE
CVE
added 2025/12/24 12:31 p.m.60 views

CVE-2025-68508

CVE-2025-68508 affects the WordPress Brave plugin’s brave-popup-builder component (Brave Brave plugin) up to version 0.8.3. The root cause is missing/incorrect authorization due to misconfigured access control levels, enabling a broken access control vulnerability. Reported details across multipl...

5.3CVSS6.6AI score0.00232EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2025/12/24 12:00 a.m.14 views

WordPress plugin Brave 安全漏洞

WordPress Brave plugin by Brave Software develops Brave Browser Extensions for WordPress integration. A lack of authorization vulnerability exists in the WordPress Brave plugin, which can be exploited by an attacker to cause the exploitation of a misconfigured access control security level...

5.3CVSS6.4AI score0.00232EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/12/23 12:25 a.m.18 views

CVE-2025-63664

Incorrect access control in the /api/v1/conversations//messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access other users' message history with AI agents...

7.5CVSS6.8AI score0.00287EPSS
SaveExploits0References1
CVE
CVE
added 2025/12/22 12:00 a.m.47 views

CVE-2025-63663

GT Edge AI Platform before v2.0.10 has an access-control flaw in the /api/v1/conversations/*/files endpoint allowing unauthorized users to access other users’ files. The issue affects GT Edge AI Platform versions prior to 2.0.10. The CVSSv3.1 base score is 7.5 (HIGH) with network attack vector an...

7.5CVSS6.4AI score0.00287EPSS
SaveExploits0References2Affected Software1
Tenable Nessus
Tenable Nessus
added 2025/12/22 12:00 a.m.8 views

Unity Linux 20.1070a Security Update: microcode_ctl (UTSA-2025-991317)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991317 advisory. Incorrect initialization of resource in the branch prediction unit for some IntelR Core Ultra Processors may allow an authenticated user to potentially enable...

6.8CVSS6.7AI score0.00184EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2025/12/19 3:31 p.m.14 views

pretix has Broken Access Control Allowing Cross-User File Access via UUID

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

7CVSS6.8AI score0.00248EPSS
SaveExploits0References4Affected Software1
RedhatCVE
RedhatCVE
added 2025/12/19 7:33 a.m.16 views

CVE-2025-58937

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Tacticool tacticool allows PHP Local File Inclusion.This issue affects Tacticool: from n/a through = 1.0.13...

8.1CVSS7.1AI score0.00499EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/12/19 7:33 a.m.10 views

CVE-2025-49041

Missing Authorization vulnerability in The African Boss Get Cash get-cash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Get Cash: from n/a through = 3.2.3...

6.5CVSS7AI score0.00403EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/12/19 7:32 a.m.12 views

CVE-2025-64214

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MasterStudy LMS Pro: from n/a through 4.7.16...

7.5CVSS7AI score0.00359EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/12/19 7:32 a.m.10 views

CVE-2025-53431

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Emberlyn emberlyn allows PHP Local File Inclusion.This issue affects Emberlyn: from n/a through = 1.3.1...

8.1CVSS7.1AI score0.00535EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/12/19 7:32 a.m.7 views

CVE-2025-53453

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Hygia hygia allows PHP Local File Inclusion.This issue affects Hygia: from n/a through = 1.16...

8.1CVSS7.1AI score0.00535EPSS
SaveExploits0References1
CVE
CVE
added 2025/12/19 12:00 a.m.26 views

CVE-2025-66911

Turms IM Server prior to 0.10.0-SNAPSHOT is affected by a broken access control vulnerability in the user online status query function. The handleQueryUserOnlineStatusesRequest() in UserServiceController.java lets any authenticated user query the online status, device information, and login times...

6.5CVSS6.4AI score0.00332EPSS
SaveExploits1References3Affected Software1
Positive Technologies
Positive Technologies
added 2025/12/19 12:00 a.m.11 views

PT-2025-52448

Name of the Vulnerable Software and Affected Versions Turms IM Server versions prior to 0.10.0-SNAPSHOT Description The software contains a flaw in access control related to querying user online status. An authenticated user can access online status, device information, and login timestamps of an...

6.5CVSS6.4AI score0.00332EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
added 2025/12/19 12:00 a.m.18 views

PT-2025-52445

Name of the Vulnerable Software and Affected Versions affected versions not specified Description An API endpoint permitted access to sensitive files belonging to other users by utilizing the file's UUID. Access was granted solely through knowledge of the UUID, bypassing intended access...

7CVSS6AI score0.00248EPSS
SaveExploits0References13
OSV
OSV
added 2025/12/19 12:00 a.m.12 views

CVE-2025-66911

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest method in UserServiceController.java allows any authenticated user to query the online status, device information, an...

6.5CVSS6.6AI score
SaveExploits0References5
EUVD
EUVD
added 2025/12/18 9:30 a.m.10 views

EUVD-2025-204225

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Gardis gardis allows PHP Local File Inclusion.This issue affects Gardis: from n/a through = 1.2.13...

8.1CVSS6.6AI score0.00499EPSS
SaveExploits0References2
OSV
OSV
added 2025/12/18 8:16 a.m.8 views

CVE-2025-60066

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Katelyn katelyn allows PHP Local File Inclusion.This issue affects Katelyn: from n/a through = 1.0.10...

8.1CVSS5.8AI score0.00499EPSS
SaveExploits0References1
OSV
OSV
added 2025/12/18 8:16 a.m.7 views

CVE-2025-60063

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Rosalinda rosalinda allows PHP Local File Inclusion.This issue affects Rosalinda: from n/a through = 1.2.3...

8.2CVSS5.8AI score0.00499EPSS
SaveExploits0References1
Rows per page
Query Builder