CVE-2025-47688

CVE-2025-47688 concerns the WordPress Advanced File Manager plugin (

CVE-2025-47612

CVE-2025-47612 (ClickWhale) is a Missing Authorization vulnerability in the flowdee ClickWhale WordPress plugin (affected: 2.4.6 and earlier). The issue arises from incorrectly configured access control, enabling unauthorized access due to insufficient authorization checks. NVD/vectors indicate a...

CVE-2025-47528 WordPress Ovation Elements plugin <= 1.1.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in pewilliams Ovation Elements ovation-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ovation Elements: from n/a through = 1.1.2...

CVE-2025-47526 WordPress GS Variation Swatches for WooCommerce plugin <= 3.0.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in GS Plugins GS Variation Swatches for WooCommerce gs-woo-variation-swatches allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Variation Swatches for WooCommerce: from n/a through = 3.0.4...

CVE-2025-47510

CVE-2025-47510 is a WordPress Display Eventbrite Events vulnerability: an authenticated (Contributor+) Local File Inclusion due to improper filename control in include/require statements. Affected software: Display Eventbrite Events = 6.3. If upgrade is not possible, apply vendor-provided mitigat...

CVE-2025-47508

The CVE refers to CVE-2025-47508 affecting WordPress GamiPress plugin versions up to 7.3.7. It is an improper control of filenames for include/require statements (PHP Local File Inclusion that can escalate to PHP Local File Inclusion). Affected product: GamiPress plugin for WordPress (

CVE-2025-47494

CVE-2025-47494 concerns the WordPress plugin EventON (EventON-lite) with an Authenticated Local File Inclusion vulnerability. The issue stems from improper control of filenames used in PHP include/require, enabling LFI for attackers who have authenticated access. Affected software versions are Ev...

CVE-2025-47486 WordPress Gutenberg & Elementor Templates Importer For Responsive <= 3.1.9 - Broken Access Control Vulnerability

Missing Authorization vulnerability in CyberChimps Gutenberg & Elementor Templates Importer For Responsive allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gutenberg & Elementor Templates Importer For Responsive: from n/a through 3.1.9...

CVE-2025-47467 WordPress GS Testimonial Slider plugin <= 3.3.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Testimonial Slider: from n/a through = 3.3.0...

CVE-2025-47465 WordPress Blocksy theme <= 2.0.97 - Broken Access Control Vulnerability

Missing Authorization vulnerability in creativethemeshq Blocksy blocksy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blocksy: from n/a through = 2.0.97...

CVE-2025-47450 WordPress Simple File List plugin <= 6.1.13 - Settings Change Vulnerability

Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through = 6.1.13...

PT-2025-20053 · Samsung · Samsung Gallery

Name of the Vulnerable Software and Affected Versions: Samsung Gallery versions prior to 14.5.10.3 in Global Android 13 Samsung Gallery versions prior to 14.5.09.3 in China Android 13 Samsung Gallery versions prior to 15.5.04.5 in Android 14 Description: The issue is related to improper access...

PT-2025-20038 · Unknown · Smart Manager

Name of the Vulnerable Software and Affected Versions: SmartManagerCN versions prior to SMR May-2025 Release 1 Description: The issue is related to improper access control, allowing local attackers to launch activities within the affected software. This could potentially lead to unauthorized acce...

PT-2025-20052 · Samsung · Samsung Gallery

Name of the Vulnerable Software and Affected Versions: Samsung Gallery versions prior to 14.5.10.3 in Global Android 13 Samsung Gallery versions prior to 14.5.09.3 in China Android 13 Samsung Gallery versions prior to 15.5.04.5 in Android 14 Description: The issue is related to improper access...

CVE-2025-0984 Arbitrary File Upload in Netoloji Software's E-Flow

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Netoloji Software E-Flow allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS, File Content Injection. This issue...

CVE-2025-45611

Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET request...

PT-2025-19779 · Hope-Boot · Hope-Boot

Name of the Vulnerable Software and Affected Versions: hope-boot version 1.0.0 Description: The issue is related to incorrect access control in the "/user/edit/" component, which allows attackers to bypass authentication by sending a crafted GET request. Recommendations: For hope-boot version...

PT-2025-19780 · Xmall · Xmall

Name of the Vulnerable Software and Affected Versions: xmall version 1.1 Description: The issue is related to incorrect access control, allowing attackers to bypass authentication. This can be achieved via a crafted GET request to the "/index" API endpoint. Recommendations: For xmall version 1.1,...

CVE-2025-45612

CVE-2025-45612 affects Xmall v1.1. The issue is an incorrect access-control implementation that lets an attacker bypass authentication by sending a crafted GET request to /index. The CVE entry is rated CVSS 3.1 with a base score of 9.8 (CRITICAL); attack vector NETWORK, no user interaction requir...

PT-2025-19785 · Unknown · Production Ssm

Name of the Vulnerable Software and Affected Versions: production ssm version v0.0.1-SNAPSHOT Description: The issue is related to incorrect access control in the component /user/list, which allows attackers to access sensitive information via a crafted payload. Recommendations: For production ss...