CVE-2025-31654

CVE-2025-31654 concerns Growatt Cloud Applications where an attacker can obtain information about the groups of smart home devices for arbitrary users (i.e., the users’ “rooms”). The CVE appears across multiple sources (NVD, Red Hat, CVE List, CVSS metrics) and is associated with the Growatt clou...

CVE-2025-27938

Growatt Cloud Applications (Growatt Cloud portal) suffers an unauthenticated authorization bypass that allows access to restricted user “rooms” information. Public docs indicate this affects versions up to 3.6.0 (and prior) and that no patch version is specified; exploitation status not publicly ...

CVE-2025-27939

CVE-2025-27939 affects Growatt Cloud Applications (version 3.6.0 and earlier per CNNVD) where an attacker can change other users’ registered email addresses and take over arbitrary accounts. The connected sources confirm the issue exists across Growatt Cloud Apps and describe account takeover via...

CVE-2025-27939 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can change registered email addresses of other users and take over arbitrary accounts...

CVE-2025-27939 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can change registered email addresses of other users and take over arbitrary accounts...

CVE-2025-30254

CVE-2025-30254 affects Growatt Cloud Applications (noted in multiple feeds). The CSC-grade description shows an unauthenticated attacker can obtain a meter serial number by querying with a user’s username. CNNVD-202504-2298 specifies vulnerable versions up to 3.6.0 and earlier; other sources reit...

CVE-2025-27568 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request...

CVE-2025-27568

Growatt Cloud Portal (Growatt Cloud Applications) is affected by CVE-2025-27568, where an unauthenticated attacker can determine a user’s email by knowing the username, causing a password-reset email to be sent. Public documents reference the authorization bypass exposure without detailing a fixe...

CVE-2025-24487 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can infer the existence of usernames in the system by querying an API...

CVE-2025-31949 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An authenticated attacker can obtain any plant name by knowing the plant ID...

Authorization Bypass Through User-Controlled Key

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key that allows an attacker to enumerate sensitive files by manipulating request...

CVE-2025-31833

Authorization Bypass Through User-Controlled Key vulnerability in themeglow JobBoard Job listing job-board-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoard Job listing: from n/a through = 1.2.8...

CVE-2025-31867

Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JS Job Manager: from n/a through 2.0.2...

CVE-2025-31833

Authorization Bypass Through User-Controlled Key vulnerability in themeglow JobBoard Job listing job-board-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoard Job listing: from n/a through = 1.2.8...

PT-2025-14212 · Themeglow · Themeglow Jobboard Job Listing

Name of the Vulnerable Software and Affected Versions: themeglow JobBoard Job listing versions 1.2.7 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, which allows exploiting incorrectly configured access control security levels...

The vulnerability of the SAP Fiori business application design platform, related to bypassing authentication using a user-controlled key, allows attackers to circumvent existing security restrictions.

The vulnerability of the SAP Fiori business application development platform involves exploiting authentication via a key controlled by the user. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...

The vulnerability of the “Manage Bank Statements” component of the SAP S/4HANA software platform allows a perpetrator to influence the integrity of the protected information.

The vulnerability of the “Manage Bank Statements” component of the SAP S/4HANA software platform involves bypassing authentication using a key controlled by the user. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the integrity of the protected informatio...

CVE-2025-28874

Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Email Assign Templates: from n/a through = 1.7...

The vulnerability of the application layer in real-time database content management system SQL Directus, related to bypassing authentication using a user-controlled key, allows attackers to gain access to the user’s account.

The vulnerability of the application layer in real-time content management system SQL Directus relates to bypassing authentication by using a user-controlled key. Exploiting this vulnerability could allow an attacker to gain access to the user account...

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition allows a hacker to bypass authentication using a user-controlled key, enabling them to disclose sensitive information that should be protected.

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition relates to the bypassing of authentication using a key controlled by the user. Exploiting this vulnerability allows a malicious actor, operating remotely, to disclose sensitive...