CVE-2025-30927 WordPress Wordapp plugin <= 1.7.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Wordapp Team Wordapp wordapp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordapp: from n/a through = 1.7.0...

CVE-2025-30958 WordPress onOffice for WP-Websites plugin <= 6.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onOffice for WP-Websites: from n/a through = 6.5.1...

CVE-2025-49289 WordPress PDF for WPForms <= 5.5.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in add-ons.org PDF for WPForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF for WPForms: from n/a through 5.5.0...

CVE-2025-49289 WordPress PDF for WPForms plugin <= 5.5.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through = 5.5.0...

CVE-2025-49288

CVE-2025-49288 – A Missing Authorization vulnerability in the WordPress plugin Ultimate WP Mail (ultimate-wp-mail) allows Authentication Bypass in versions

PT-2025-24112 · Woocommerce · Ticketbai Facturas Para Woocommerce

Name of the Vulnerable Software and Affected Versions: TicketBAI Facturas para WooCommerce versions 3.19 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

PT-2025-24184 · Unknown · Dor Zuberi Slack Notifications

Name of the Vulnerable Software and Affected Versions: Dor Zuberi Slack Notifications versions through 2.0.7 Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For versions...

PT-2025-24203 · Unknown · Nk Docspress

Name of the Vulnerable Software and Affected Versions: nK DocsPress versions through 2.5.2 Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions through 2.5.2,...

PT-2025-24264 · WordPress · Wp Map Plugins Interactive Regional Map Of Florida

Name of the Vulnerable Software and Affected Versions: WP Map Plugins Interactive Regional Map of Florida versions 1.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels...

CVE-2025-3768

Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking feature when the Devolutions hosted endpoint is not reachable...

Privilege Escalation

org.wso2.am, am-parent, org.wso2.is, identity-server-parent are vulnerable to privilege escalation. The vulnerability is due to improper validation and access control in the SOAP admin services, which allows attackers to assign elevated privileges to self-registered users under specific deploymen...

WordPress Foxit eSign for WordPress plugin <= 2.0.3 - Other Vulnerability Type Vulnerability

Other Vulnerability Type Vulnerability discovered by Denver Jackson in WordPress Plugin Foxit eSign for WordPress versions = 2.0.3...

CVE-2025-20259

Cisco ThousandEyes Endpoint Agent for Windows is affected by vulnerabilities in the update process that allow an authenticated, local attacker to delete arbitrary files via a symbolic-link upgrade path. Root cause: improper access controls on local filesystem during the agent upgrade, enabling th...

Grafana 11.2.x < 11.2.10 Improper Access Control

According to its self-reported version, the Grafana install hosted on the remote host is earlier than 10.4.19, or 11.2.x earlier than 11.2.10, or 11.3.x earlier than 11.3.7, or 11.4.x earlier than 11.4.5, or 11.5.x earlier than 11.5.5, or 11.6.x earlier than 11.6.2, or 12.0.x earlier than 12.0.1...

PT-2025-23745

Name of the Vulnerable Software and Affected Versions AudioService versions prior to SMR Jun-2025 Release 1 Description The issue is related to improper access control in the AudioService, allowing local attackers to access sensitive information. Recommendations For versions prior to SMR Jun-2025...

Grafana 11.5.x < 11.5.5 Improper Access Control

According to its self-reported version, the Grafana install hosted on the remote host is earlier than 10.4.19, or 11.2.x earlier than 11.2.10, or 11.3.x earlier than 11.3.7, or 11.4.x earlier than 11.4.5, or 11.5.x earlier than 11.5.5, or 11.6.x earlier than 11.6.2, or 12.0.x earlier than 12.0.1...

CVE-2025-4433

Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Management" permissions to perform privilege escalation by adding users to groups with administrative privileges...

CVE-2025-5390 JeeWMS File filedeal.do filedeal access control

A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /systemController/filedeal.do of the component File Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. Th...

CVE-2025-5389 JeeWMS File generateController.do dogenerateOne2Many access control

A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the file /generateController.do?dogenerateOne2Many of the component File Handler. The manipulation leads to improper access controls. The attack...

CVE-2025-3611 Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team...