Meshtastic 授权问题漏洞

Meshtastic is a decentralized wireless off-grid mesh network LoRa protocol open-sourced by Meshtastic. An authorization issue vulnerability exists in Meshtastic versions prior to 2.6.3, which stems from bypassing public key authentication and could lead to malicious key overwriting...

CVE-2025-55675 Apache Superset: Incorrect datasource authorization on REST API

Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasourceid in the URL, an attacker can...

WordPress plugin Nexter Blocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-33247 · Hastech · Hastech Ht Mega

Name of the Vulnerable Software and Affected Versions: HasTech HT Mega versions through 2.9.0 Description: A missing authorization flaw exists in HasTech HT Mega, allowing exploitation of incorrectly configured access control security levels. Recommendations: Update HasTech HT Mega to a version...

PT-2025-33203 · Syedamirhussain91 · Db Backup

Name of the Vulnerable Software and Affected Versions: syedamirhussain91 DB Backup versions through 6.0 Description: A missing authorization flaw in syedamirhussain91 DB Backup allows exploitation due to incorrectly configured access control security levels. Recommendations: Update to a version...

PT-2025-33161 · Themeatelier · Idonatepro

Name of the Vulnerable Software and Affected Versions: IDonatePro versions n/d through 2.1.9 Description: A missing authorization flaw in ThemeAtelier IDonatePro allows exploitation due to incorrectly configured access control security levels. Recommendations: Update IDonatePro to a version later...

PT-2025-33211 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: Event Manager, Event Calendar and Booking Plugin for WordPress versions not specified through 4.0.24 Description: A missing authorization flaw exists in the theme function of the WordPress Event Manager, Event Calendar and Booking Plugin. Thi...

PT-2025-33382 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: hashthemes Easy Elementor Addons versions through 2.2.7 Description: The software contains a missing authorization flaw that allows exploiting incorrectly configured access control security levels. Recommendations: Update hashthemes Easy...

PT-2025-33213 · WordPress · Project Cost Calculator

Name of the Vulnerable Software and Affected Versions: Ronik@UnlimitedWP Project Cost Calculator versions through 1.0.0 Description: A missing authorization flaw exists in Ronik@UnlimitedWP Project Cost Calculator due to incorrectly configured access control security levels. Recommendations: At t...

PT-2025-33216 · Unity Business Technology Pty · The E-Commerce Erp

Name of the Vulnerable Software and Affected Versions: The E-Commerce ERP versions n/a through 2.1.1.3 Description: A missing authorization flaw exists in Unity Business Technology Pty Ltd The E-Commerce ERP. This issue allows access to functionality that is not properly restricted by Access...

PT-2025-33388 · Unknown · Pareto Digital Embedder For Google Reviews

Name of the Vulnerable Software and Affected Versions: PARETO Digital Embedder for Google Reviews versions n/a through 1.7.3 Description: A missing authorization flaw exists in PARETO Digital Embedder for Google Reviews. This issue allows access to functionality that is not properly constrained b...

CVE-2011-10013

Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php...

Apache Tomcat 授权问题漏洞

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server for the implementation of Servlet and JavaServer Page JSP support. Apache Tomcat suffers from an authorization problem vulnerability that stems from a rewrite valve session fixation flaw. An attack...

Traq 安全漏洞

Traq is a PHP-based project management and issue tracking system from the individual developer Jack Polgar. A security vulnerability exists in Traq versions 2.0 through 2.3, which stems from a flaw in the authorization logic of the admincp/common.php script that could lead to remote code executio...

Magento has incorrect authorization issue that leads to arbitrary file system read

Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized...

CVE-2025-8310

Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password...

CVE-2025-42951

CVE-2025-42951 corresponds to a broken authorization flaw in SAP Business One (SLD). An authenticated attacker can invoke the relevant API to gain administrator privileges on the database, impacting confidentiality, integrity, and availability. The CVSS 3.1 metrics indicate network access with lo...

SAP Business One 安全漏洞

SAP Business One is a suite of business management software from the German company SAP. The software includes functions for financial management, operations management and human resource management. A security vulnerability exists in SAP Business One, which stems from a flaw in the authorization...

CVE-2025-53910 Unauthorized Channel Subscription Edit in Mattermost Confluence Plugin

Mattermost Confluence Plugin version 1.5.0 fails to check the access of the user to the channel which allows attackers to create a channel subscription without proper access to the channel via API call to the edit channel subscription endpoint...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of Ji Sheng Hua in China. A security vulnerability exists in jshERP Huaxia ERP version 3.5 and earlier, which originates from an authorization flaw due to improper handling of parameter ids in file /jshERP-boot/user/deleteBat...