CVE-2025-11669

The vulnerability CVE-2025-11669 affects Zohocorp ManageEngine PAM360 (versions before 8202), Password Manager Pro (before 13221), and Access Manager Plus (before 4401). It is described as an authorization issue in the initiate remote session functionality. Remediation: upgrade PAM360 to 8202 or ...

WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by John P in WordPress Theme Travel Monster versions = 1.3.3...

WordPress Breeze plugin <= 2.2.21 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Breeze versions = 2.2.21...

CVE-2025-59022 TYPO3 CMS Allows Broken Access Control in Recycler Module

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website...

CVE-2025-59022 TYPO3 CMS Allows Broken Access Control in Recycler Module

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website...

CVE-2025-59021

CVE-2025-59021 affects TYPO3 CMS. Backend users with redirects module access and write permission on the sys_redirect table could read, create, and modify any redirect record, bypassing user-mounted scoping and enabling redirects to arbitrary URLs (phishing- or abuse‑prone). Affected versions: 10...

CVE-2025-59021 TYPO3 CMS Allows Broken Access Control in Redirects Module

Backend users with access to the redirects module and write permission on the sysredirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs...

EUVD-2026-2089

Backend users with access to the redirects module and write permission on the sysredirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs...

CVE-2025-59020 TYPO3 CMS Allows Broken Access Control in Edit Document Controller

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced s...

CVE-2025-59020 TYPO3 CMS Allows Broken Access Control in Edit Document Controller

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced s...

CVE-2025-59020

The CVE-2025-59020 issue in TYPO3 CMS arises from abusing the defVals parameter to bypass field-level access checks during backend record creation. This allows insertion of data into restricted exclude fields for tables where the user has write access to a limited set of fields. Affected TYPO3 ve...

WordPress Solace theme <= 2.1.16 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Denver Jackson in WordPress Theme Solace versions = 2.1.16...

MiracleLinux 9 : kernel-5.14.0-611.5.1.el9_7 (AXSA:2025-11493:94)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11493:94 advisory. kernel: can: isotp: fix potential CAN frame reception race in isotprcv CVE-2022-48830 kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB...

WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin MetForm Pro versions = 3.9.1...

WordPress Responsive Addons for Elementor plugin <= 2.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abu Hurayra in WordPress Plugin Responsive Addons for Elementor versions = 2.0.8...

WordPress Electron theme <= 1.8.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Electron versions = 1.8.2...

WordPress xSmart theme <= 1.2.9.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme xSmart versions = 1.2.9.4...

WordPress Orchid Store theme <= 1.5.15 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by John P in WordPress Theme Orchid Store versions = 1.5.15...

WordPress WP Page Permalink Extension plugin <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Rewrite Rules Flush vulnerability discovered by Legion Hunter in WordPress Plugin WP Page Permalink Extension versions = 1.5.4...

WordPress Ecwid Shopping Cart plugin <= 7.0.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Ecwid Shopping Cart versions = 7.0.6...