CVE-2025-10390

A weakness has been identified in CRMEB up to 5.6.1. The affected element is the function editAddress of the file app/services/user/UserAddressServices.php. Executing manipulation of the argument ID can lead to improper authorization. The attack may be launched remotely. The exploit has been made...

newbee-mall 授权问题漏洞

newbee-mall is a newbee open source e-commerce system . There is an authorization issue vulnerability in newbee-mall, which stems from improper handling of the parameter orderNo of the component Order Status Handler in file/paySuccess, which may lead to improper authorization...

Apple多款产品 安全漏洞

Apple iOS and others are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for iPad tablets.Apple visionOS is an operating system for AR glasses. A security vulnerability exists in several Apple products that stems from an...

CVE-2025-10319

A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the component Tenant Log Export. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been...

CVE-2025-10390

CVE-2025-10390 affects CRMEB up to 5.6.1, with the vulnerability located in the editAddress function of app/services/user/UserAddressServices.php. Manipulating the ID parameter can lead to improper authorization, and the issue may be exploitable remotely. Public exploit availability is noted; mul...

CVE-2025-10390 CRMEB UserAddressServices.php editAddress improper authorization

A weakness has been identified in CRMEB up to 5.6.1. The affected element is the function editAddress of the file app/services/user/UserAddressServices.php. Executing manipulation of the argument ID can lead to improper authorization. The attack may be launched remotely. The exploit has been made...

CVE-2025-10278

A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and...

CVE-2025-10389 CRMEB Administrator Password SystemAdminServices.php save improper authorization

A security flaw has been discovered in CRMEB up to 5.6.1. Impacted is the function Save of the file app/services/system/admin/SystemAdminServices.php of the component Administrator Password Handler. Performing manipulation of the argument ID results in improper authorization. The attack may be...

CVE-2025-10276

A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorization. Remote exploitation of the attack is possible. The...

CVE-2025-10291

Affects linlinjava litemall up to 1.8.0. The vulnerability resides in WxAftersaleController at /wx/aftersale/cancel, where manipulating the ID argument can cause improper authorization. Exploitation can be performed remotely, and public exploits exist. Multiple sources confirm the issue and note ...

CVE-2025-10276

A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorization. Remote exploitation of the attack is possible. The...

ruoyi-vue-pro 授权问题漏洞

ruoyi-vue-pro is China's Taro Road source code zhijiantianya open source an optimized refactoring of efficient backend management system framework for the development of enterprise backend , SaaS platforms , WeChat small program backend and so on. ruoyi-vue-pro 2025.09 and previous versions of th...

JeecgBoot 授权问题漏洞

JeecgBoot is a Java low-code platform for enterprise web applications from China National Torch Jeecg. An authorization issue vulnerability exists in JeecgBoot 3.8.2 and earlier versions, which stems from improper authorization of the parameter userIds in the file /api/system/sendWebSocketMsg in...

ruoyi-vue-pro 授权问题漏洞

ruoyi-vue-pro is China's Taro Road source code zhijiantianya open source an optimized refactoring of the efficient backend management system framework for the development of enterprise backend , SaaS platforms , WeChat small program backend and so on. ruoyi-vue-pro 2025.09 and previous versions o...

LibreChat 授权问题漏洞

LibreChat is an enhanced ChatGPT clone by Danny Avila Personal Developer. An authorization issue vulnerability exists in LibreChat version 0.7.8, which stems from improper authorization controls for the conversation sharing feature and could lead to unauthorized access to other users' conversatio...

CVE-2025-10209 Papermerge DMS Authorization Token improper authorization

A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Performing manipulation results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public...

CVE-2025-10073

A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized...

WordPress plugin Maspik 安全漏洞

WordPress Maspik plugin is an anti-spam plugin for WordPress that is mainly used to protect website contact forms, comment areas and signup forms from spam. WordPress Maspik plugin suffers from an authorization issue vulnerability that stems from a lack of capability check in the function...

CVE-2025-58134

CVE-2025-58134 concerns Zoom Workplace Windows clients. Multiple sources confirm an Incorrect authorization issue that may allow an authenticated user to impact integrity over the network. Affected products include Zoom Workplace Clients for Windows (and related VDI/WIN components in Nessus refer...

CVE-2025-58980

CVE-2025-58980 describes a Missing Authorization vulnerability in the WordPress plugin Export WP Page to Static HTML/CSS , affecting versions from n/a up to and including 4.1.0 . Root cause: lack of proper authorization checks allows accessing functionality not constrained by ACLs. Impact: unauth...