CVE-2025-66551 Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 and 0.9.3...

CVE-2025-66551 Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 and 0.9.3...

Contacts search allowed users to retrieve contact information of other users beyond their contact list

None...

Missing ownership check in Tables app allows moving columns into tables of other users

None...

CVE-2025-65097

RomM (ROM Manager) prior to versions 4.4.1 and 4.4.1-beta.2 is affected by an IDOR-like issue where an authenticated user can delete other users’ collections by sending a DELETE request to the /collections endpoint without ownership verification. Exploitation details or in-the-wild status are not...

GHSA-P6GJ-JC38-X2M7 Mattermost fails to validate user permissions when deleting comments in Boards

Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users...

ASB-A-327137311

In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2025-55471

Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other users...

CVE-2025-55471

Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other users...

PT-2025-48166

Name of the Vulnerable Software and Affected Versions youlai-boot version 2.21.1 Description An access control issue exists in the getUserFormData function. This allows unauthorized access to sensitive information belonging to other users. The issue involves insufficient restrictions on who can...

CVE-2025-55471

CVE-2025-55471 affects youlai-boot v2.21.1; the root cause is incorrect access control in the getUserFormData function , enabling attackers to access sensitive information of other users. The CVE is described with a HIGH impact (C at least Confidentiality). Public references indicate multiple ven...

CVE-2025-12040

The Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.3 via several functions in class-th-wishlist-frontend.php due to missing validation on a user controlled key. This makes it possible for unauthenticated...

CVE-2025-64299

LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes...

PT-2025-47670

LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes...

CVE-2025-52669

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system...

CVE-2025-52669

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system...

CVE-2025-65034

CVE-2025-65034 affects Rallly prior to version 4.5.4. The vulnerability is an improper authorization that allows any authenticated user to reopen finalized polls owned by other users by manipulating the pollId parameter, potentially disrupting events and compromising availability and integrity of...

CVE-2025-11532

The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the 'wishlistid' user controlled key. This makes it possible for unauthenticated attackers to remove and add items to other user's wishlists...

EUVD-2025-60937

The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the 'wishlistid' user controlled key. This makes it possible for unauthenticated attackers to remove and add items to other user's wishlists...

CVE-2025-11532

The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the 'wishlistid' user controlled key. This makes it possible for unauthenticated attackers to remove and add items to other user's wishlists...