CVE-2025-47472 WordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in codepeople Music Player for WooCommerce music-player-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Player for WooCommerce: from n/a through = 1.5.1...

CVE-2025-47469 WordPress Media Hygiene plugin <= 4.0.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Hygiene: from n/a through = 4.0.0...

CVE-2025-47467

CVE-2025-47467 relates to a Missing Authorization vulnerability in WordPress GS Testimonial Slider (GS Testimonial Slider

CVE-2025-47465 WordPress Blocksy <= 2.0.97 - Broken Access Control Vulnerability

Missing Authorization vulnerability in CreativeThemes Blocksy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Blocksy: from n/a through 2.0.97...

WordPress Graphina plugin <= 3.0.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Anhchangmutrang in WordPress Plugin Graphina versions = 3.0.4...

WordPress Envo Extra plugin <= 1.9.9 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin Envo Extra versions = 1.9.9...

CVE-2025-20966

Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows physical attackers to access data across multiple user profiles...

CVE-2025-20970

Improper access control in Bixby Vision prior to version 3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15 allows local attackers to access image files with Bixby Vision privilege...

PT-2025-20231 · Unknown · Contentstudio

Name of the Vulnerable Software and Affected Versions: ContentStudio versions 1.3.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: For ContentStudio...

WordPress Login Lockdown & Protection plugin <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary IP Whitelisting vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Login Lockdown versions = 2.11...

CVE-2025-46587

Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-46587

Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-46586

Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2025-45617

Incorrect access control in the component /user/list of productionssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload...

CVE-2025-4269 TOTOLINK A720R Log cstecgi.cgi access control

A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The manipulation of the argument topicurl with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog...

PT-2025-19776 · Xinguan · Xinguan

Name of the Vulnerable Software and Affected Versions: Xinguan version 0.0.1-SNAPSHOT Description: The issue is related to incorrect access control in the "/system/user/findUserList" API endpoint, which allows attackers to access sensitive information by sending a crafted payload. Recommendations...

CVE-2025-45237

Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive account information, including the encrypted password...

Vulnerability of the hid_ctrl() function in the drivers/hid/usbhid/hid-core.c module – The driver for the user interface devices of the Linux kernel allows a hacker to compromise the confidentiality and accessibility of protected information.

Vulnerability of the hidctrl function in the drivers/hid/usbhid/hid-core.c module – The driver for the user interface devices in the Linux kernel is vulnerable to a memory leak before the last reference is freed. Exploiting this vulnerability could allow an attacker to compromise the...

PT-2025-18704 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue is related to inadequate access controls in the web management portal, allowing an unauthenticated remote attacker to enable ate, a remote system management binary, by sending a...

CVE-2025-46552

KHC-INVITATION-AUTOMATION (GitHub script) has a vulnerability in version 1.2 where API responses could expose user data (email addresses, Discord usernames) due to missing access controls. The issue was identified in certain commits and has been patched in a later commit of version 1.2. No exploi...