XWiki 1.8.1 < 14.10.22, 15.0-rc-1 < 15.10.12, 16.0.0-rc-1 < 16.4.3, 16.5.0-rc-1 < 16.7.0 Improper Authorization Vulnerability (GHSA-r5cr-xm48-97xp)

Xwiki is prone to an improper authorization vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Houzez versions = 4.0.4...

CVE-2025-50028 WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

CVE-2025-50028 WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

CVE-2025-49888 WordPress PW WooCommerce On Sale! plugin <= 1.39 - Broken Access Control Vulnerability

Missing Authorization vulnerability in pimwick PW WooCommerce On Sale! allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PW WooCommerce On Sale!: from n/a through 1.39...

CVE-2025-54047 WordPress Cost Calculator plugin <= 7.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator: from n/a through = 7.4...

CVE-2025-54011 WordPress SMTP2GO plugin <= 1.12.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in SMTP2GO SMTP2GO smtp2go allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMTP2GO: from n/a through = 1.12.1...

PT-2025-29816 · Unknown · Uxper Sala

Name of the Vulnerable Software and Affected Versions: uxper Sala versions n/a through 1.1.3 Description: A missing authorization issue exists in uxper Sala, allowing access to functionality not properly constrained by Access Control Lists ACLs. Recommendations: Update uxper Sala to a version...

CVE-2025-7552

Dromara Northstar up to version 7.3.5 contains a vulnerability in the preHandle function of AuthorizationInterceptor.java (Path Handler) where the Request parameter can be manipulated to bypass access controls. The issue may be exploitable remotely and affects how unauthorized access to restricte...

PT-2025-29397 · Dromara · Dromara Northstar

Name of the Vulnerable Software and Affected Versions: Dromara Northstar versions through 7.3.5 Description: A critical issue exists in Dromara Northstar related to improper access controls. The preHandle function within the Path Handler component, specifically in the file...

CVE-2025-53709

The CVE-2025-53709 entries describe a privilege/authorization issue in Palantir Secure-upload, a data submission service installed on a limited set of environments. Affected component: Secure-upload before version 0.815.0. Reported problems include: privileged users could select email templates n...

CVE-2025-7031 Config Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-086

Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Config Pages Viewer: from 0.0.0 before 1.0.4...

CVE-2025-36600

CVE-2025-36600 involves Dell Client Platform BIOS with an Improper Access Control on Mirrored or Aliased Memory Regions in an externally developed component. A high-privilege attacker with local access could potentially achieve code execution. The vulnerability is rooted in improper access contro...

CVE-2025-21005

The CVE-2025-21005 entry concerns the isemtelephony component, with the issue described as improper access control. Affected software isemtelephony is prior to Android 15, where local attackers could access sensitive information due to insufficient access restrictions. The PT Security advisory (P...

CVE-2025-20998

CVE-2025-20998 affects Samsung Galaxy Watch via SamsungAccount. The issue is described as improper access control that could allow a local attacker to access a phone number on devices running versions prior to SMR Jul-2025 Release 1. The root cause is the improper access control in SamsungAccount...

SAP NetWeaver Enterprise Portal Administration 代码问题漏洞

SAP NetWeaver Enterprise Portal Administration is an access control software from SAP, Germany. A code issue vulnerability exists in SAP NetWeaver Enterprise Portal Administration, which originates from a privileged user being able to upload untrusted content that, when deserialized, could impact...

CVE-2025-6044

An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical attacker to bypass the lock screen and access user files by removing the stylus while the device is closed and using the screen capture...

CVE-2025-20323 Missing Access Control of Saved Searches in the Splunk Archiver app

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn off the scheduled search Bucket Copy Trigger within the Splunk Archiver application. This is because of missing access controls in the saved...

PT-2025-28041 · Blackvue · Blackvue Dashcam 590X

Name of the Vulnerable Software and Affected Versions: BlackVue Dashcam 590X up to 20250624 Description: A critical issue affects some unknown functionality of the file /upload.cgi of the component Configuration Handler, leading to improper access controls. The attack must be initiated within the...

CVE-2025-47634 WordPress WC Pickup Store plugin <= 1.8.9 - Settings Change Vulnerability

Missing Authorization vulnerability in Keylor Mendoza WC Pickup Store wc-pickup-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Pickup Store: from n/a through = 1.8.9...