PT-2025-53090

Name of the Vulnerable Software and Affected Versions Spiffy Plugins Spiffy Calendar versions through 5.0.7 Description An authorization issue exists in Spiffy Plugins Spiffy Calendar spiffy-calendar, allowing exploitation due to incorrectly configured access control security levels...

PT-2025-53275

Name of the Vulnerable Software and Affected Versions Watu Quiz versions through 3.4.5 Description An authorization issue exists in Watu Quiz that allows exploitation due to incorrectly configured access control security levels. Recommendations Update Watu Quiz to a version later than 3.4.5...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to insufficient validation of the serviceAccount path in the HashiCorp Vault authentication process. An attacker can access and exfiltrate arbitrary files from the node's filesystem by creating or modifying a...

PT-2025-52567

Name of the Vulnerable Software and Affected Versions HappyFiles Pro versions through 1.8.1 Description An authorization issue exists in HappyFiles Pro, allowing exploitation due to incorrectly configured access control security levels. This can lead to unauthorized access. Recommendations Update...

PT-2025-52566

Name of the Vulnerable Software and Affected Versions Mapro Collins Magazine Edge versions through 1.13 Description An authorization issue exists in Mapro Collins Magazine Edge due to incorrectly configured access control security levels. This allows for exploitation of the system. Recommendation...

Security update for grafana

This update for grafana fixes the following issues: grafana was updated from version 11.5.5 to 11.5.10: Security issues fixed: CVE-2025-64751: Dropped experimental implementation of authorization Zanzana server/client version 11.5.10 bsc1254113 CVE-2025-47911: Fixed parsing HTML documents version...

CVE-2025-47382 Incorrect Authorization in Boot

Memory corruption while loading an invalid firmware in boot loader...

Microsoft Partner Center 授权问题漏洞

Microsoft Partner Center is an online platform from Microsoft Corporation USA. An authorization issue vulnerability exists in Microsoft Partner Center that stems from improper authorization and could allow an unauthorized attacker to elevate privileges over the network...

WordPress plugin ListingPro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

WordPress plugin PostX 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

WordPress Essential Blocks plugin <= 5.7.2 - Missing Authorization To Authenticated (Author+) Information Disclosure vulnerability

Missing Authorization To Authenticated Author+ Information Disclosure vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Essential Blocks for Gutenberg versions = 5.7.2...

CVE-2025-64246 WordPress Accessibility by AudioEye plugin <= 1.0.49 - Broken Access Control vulnerability

Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility by AudioEye: from n/a through = 1.0.49...

Ningyuanda TC155 授权问题漏洞

The Ningyuanda TC155 is an IP camera from the Chinese company Ningyuanda. An authorization issue vulnerability exists in the Ningyuanda TC155 version 57.0.2.0, which stems from improper authentication of the RTSP real-time video streaming endpoint component, which could lead to unauthorized acces...

EUVD-2025-203286

The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them...

CVE-2025-14508 MediaCommander – Bring Folders to Media, Posts, and Pages <= 2.3.1 - Missing Authorization to Authenticated (Author+) Media Folder Deletion

The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using uploadfiles capabilit...

mall-swarm authorization issue vulnerability

mall-swarm is a microservice mall system. An authorization issue vulnerability exists in mall-swarm, which stems from incorrect manipulation of the parameter ids in the file /member/readHistory/delete, for which no detailed vulnerability details are provided at this time...

DB Elettronica Screen SFT DAB 授权问题漏洞

DB Elettronica Screen SFT DAB is a series of digital audio broadcast transmitters from DB Elettronica, Italy. An authorization issue vulnerability exists in DB Elettronica Screen SFT DAB version 1.9.3, which stems from a flaw in session management that could lead to password changes...

CVE-2025-42891

Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of database tables into an ABAP report. This could lead to a high impact on data confidentiality and a low impact on data integrity. There is no impact on...

CVE-2025-67568 WordPress Basel theme <= 5.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in xtemos Basel basel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Basel: from n/a through = 5.9.1...

FreePBX Endpoint Manager 授权问题漏洞

FreePBX Endpoint Manager is a centralized IP phone endpoint configuration module from the FreePBX open source. An authorization issue vulnerability exists in FreePBX Endpoint Manager that stems from an authentication bypass that could lead to unauthorized access...