GHSA-CM2R-RG7R-P7GG File Browser vulnerable to insecure password handling

Summary All user accounts authenticate towards a File Browser instance with a password. A missing password policy and brute-force protection makes it impossible for administrators to properly secure the authentication process. Impact Attackers can mount a brute-force attack against the passwords ...

Dell OpenManage Network Integration 安全漏洞

Dell OpenManage Network Integration is a set of system management tools provided by Dell for integrating third-party management platforms such as PowerEdge servers, VMware vCenter, and others. An authentication vulnerability exists in Dell OpenManage Network Integration that originates from an...

CVE-2025-24292

A misconfigured query in UniFi Network v9.1.120 and earlier could allow users to authenticate to Enterprise WiFi or VPN Server l2tp and OpenVPN using a device’s MAC address from 802.1X or MAC Authentication, if both services are enabled and share the same RADIUS profile...

CVE-2025-24292

Summary: CVE-2025-24292 affects UniFi Network (v9.1.120 and earlier). A misconfigured query could allow a user to authenticate to Enterprise WiFi or VPN Server (L2TP/OpenVPN) using a device’s MAC address from 802.1X or MAC Authentication when both services are enabled and share the same RADIUS pr...

CVE-2025-5310 Dover Fueling Solutions ProGauge MagLink LX Consoles Missing Authentication for Critical Function

Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework TCF interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution...

CVE-2025-3699

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A all versions, GB-50 all versions, GB-50A all versions, GB-24A all versions, G-150AD all versions, AG-150A-A all versions, AG-150A-J all versions, GB-50AD all...

CVE-2025-49851

ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product...

CVE-2025-4383

Improper Restriction of Excessive Authentication Attempts vulnerability in Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Wi-Fi Cloud Hotspot allows Authentication Abuse, Authentication Bypass. This issue affects Wi-Fi Cloud Hotspot: before 30.05.2025...

CVE-2025-3092

An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint...

CVE-2025-6290

Summary: CVE-2025-6290 affects the WordPress plugin “Tournament Bracket Generator” up to version 1.0.0. The root cause is insufficient input sanitization and output escaping in the plugin’s bracket shortcode, enabling a stored Cross-Site Scripting (XSS) attack. Affected component: bracket shortco...

CVE-2025-49851 Improper Authentication in ControlID iDSecure On-premises

ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product...

CVE-2024-56918

In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting XSS, which allows a privileged, authenticated attacker to exfiltrate user input from the login form...

CVE-2025-3090

CVE-2025-3090 affects MB Connect Line mbCONNECT24, mymbCONNECT24 (and related Helmholz/MB products) with a common root cause: missing authentication for a critical function. This enables an unauthenticated remote attacker to access limited sensitive information and/or trigger denial of service ov...

Missing Authentication For Critical Function

Apache SeaTunnel is vulnerable to Missing Authentication For Critical Function. The vulnerability is due to insufficient access control and improper input validation due to unauthorized access to the /hazelcast/rest/maps/submit-job endpoint, allowing attackers to exploit the MySQL URL parameters...

The vulnerability of the Dante proxy server, related to deficiencies in the authentication mechanism, allows attackers to circumvent existing security restrictions.

The vulnerability of the Dante proxy server is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...

CVE-2025-23092

Mitel OpenScape Accounting Management through V5 R1.1.0 could allow an authenticated attacker with administrative privileges to conduct a path traversal attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to upload arbitrary files and execute...

CVE-2023-47298

An issue in NCR Terminal Handler 1.5.1 allows a low-level privileged authenticated attacker to query the SOAP API endpoint to obtain information about all of the users of the application including their usernames, roles, security groups and account statuses...

CVE-2025-6257 Euro FxRef Currency Converter <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via currency Shortcode

The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-5234

CVE-2025-5234 affects the Gutenverse News WordPress plugin (versions up to 1.0.4). It is a Stored Cross-Site Scripting vulnerability via the elementId parameter, exploitable by authenticated attackers with Contributor-level access or higher. The payload can cause arbitrary scripts to run on pages...

CVE-2025-5071 AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP

The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'MeowMWAILabsMCP::canaccessmcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and...