CVE-2025-68593 WordPress WP Adminify plugin <= 4.0.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through = 4.0.6.1...

CVE-2025-68521 WordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through = 4.9.5...

CVE-2025-68508

CVE-2025-68508 affects the WordPress Brave plugin’s brave-popup-builder component (Brave Brave plugin) up to version 0.8.3. The root cause is missing/incorrect authorization due to misconfigured access control levels, enabling a broken access control vulnerability. Reported details across multipl...

WordPress plugin Brave 安全漏洞

WordPress Brave plugin by Brave Software develops Brave Browser Extensions for WordPress integration. A lack of authorization vulnerability exists in the WordPress Brave plugin, which can be exploited by an attacker to cause the exploitation of a misconfigured access control security level...

CVE-2025-63664

Incorrect access control in the /api/v1/conversations//messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access other users' message history with AI agents...

CVE-2025-63663

GT Edge AI Platform before v2.0.10 has an access-control flaw in the /api/v1/conversations/*/files endpoint allowing unauthorized users to access other users’ files. The issue affects GT Edge AI Platform versions prior to 2.0.10. The CVSSv3.1 base score is 7.5 (HIGH) with network attack vector an...

Unity Linux 20.1070a Security Update: microcode_ctl (UTSA-2025-991317)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991317 advisory. Incorrect initialization of resource in the branch prediction unit for some IntelR Core Ultra Processors may allow an authenticated user to potentially enable...

pretix has Broken Access Control Allowing Cross-User File Access via UUID

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

CVE-2025-58937

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Tacticool tacticool allows PHP Local File Inclusion.This issue affects Tacticool: from n/a through = 1.0.13...

CVE-2025-49041

Missing Authorization vulnerability in The African Boss Get Cash get-cash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Get Cash: from n/a through = 3.2.3...

CVE-2025-64214

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MasterStudy LMS Pro: from n/a through 4.7.16...

CVE-2025-53431

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Emberlyn emberlyn allows PHP Local File Inclusion.This issue affects Emberlyn: from n/a through = 1.3.1...

CVE-2025-53453

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Hygia hygia allows PHP Local File Inclusion.This issue affects Hygia: from n/a through = 1.16...

CVE-2025-66911

Turms IM Server prior to 0.10.0-SNAPSHOT is affected by a broken access control vulnerability in the user online status query function. The handleQueryUserOnlineStatusesRequest() in UserServiceController.java lets any authenticated user query the online status, device information, and login times...

PT-2025-52448

Name of the Vulnerable Software and Affected Versions Turms IM Server versions prior to 0.10.0-SNAPSHOT Description The software contains a flaw in access control related to querying user online status. An authenticated user can access online status, device information, and login timestamps of an...

PT-2025-52445

Name of the Vulnerable Software and Affected Versions affected versions not specified Description An API endpoint permitted access to sensitive files belonging to other users by utilizing the file's UUID. Access was granted solely through knowledge of the UUID, bypassing intended access...

CVE-2025-66911

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest method in UserServiceController.java allows any authenticated user to query the online status, device information, an...

EUVD-2025-204225

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Gardis gardis allows PHP Local File Inclusion.This issue affects Gardis: from n/a through = 1.2.13...

CVE-2025-60066

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Katelyn katelyn allows PHP Local File Inclusion.This issue affects Katelyn: from n/a through = 1.0.10...

CVE-2025-60063

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Rosalinda rosalinda allows PHP Local File Inclusion.This issue affects Rosalinda: from n/a through = 1.2.3...