CVE-2025-65213

MooreThreads torchmusa through all versions contains an unsafe deserialization vulnerability in torchmusa.utils.comparetool. The compareforsingleop and naninftrackforsingleop functions use pickle.load on user-controlled file paths without validation, allowing arbitrary code execution. An attacker...

PT-2025-51420

Name of the Vulnerable Software and Affected Versions FAPI Member versions through 2.2.26 Description An authorization bypass exists due to incorrectly configured access control security levels in FAPI Member. This allows exploitation through a user-controlled key. Recommendations Update FAPI...

PT-2025-51440

Name of the Vulnerable Software and Affected Versions Barn2 Plugins Document Library Lite versions through 1.1.7 Description An authorization bypass exists due to incorrectly configured access control security levels in Barn2 Plugins Document Library Lite. This allows for unauthorized access. The...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a client-controlled flag in the captcha verification. An attacker can bypass authentication mechanisms by manipulating the flag value during the verification process. Remediation...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a client-controlled flag in the captcha verification. An attacker can bypass authentication mechanisms by manipulating the flag value during the verification process. Remediation...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a client-controlled flag in the captcha verification. An attacker can bypass authentication mechanisms by manipulating the flag value during the verification process. Remediation...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a client-controlled flag in the captcha verification. An attacker can bypass authentication mechanisms by manipulating the flag value during the verification process. Remediation...

GO-2025-4209 1Panel – CAPTCHA Bypass via Client-Controlled Flag in github.com/1Panel-dev/1Panel

1Panel – CAPTCHA Bypass via Client-Controlled Flag in github.com/1Panel-dev/1Panel...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a client-controlled flag in the captcha verification. An attacker can bypass authentication mechanisms by manipulating the flag value during the verification process. Remediation...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a client-controlled flag in the captcha verification. An attacker can bypass authentication mechanisms by manipulating the flag value during the verification process. Remediation...

CVE-2025-65213

MooreThreads torchmusa through all versions contains an unsafe deserialization vulnerability in torchmusa.utils.comparetool. The compareforsingleop and naninftrackforsingleop functions use pickle.load on user-controlled file paths without validation, allowing arbitrary code execution. An attacker...

PT-2025-51258

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions through 15.89.0 Description A Server-Side Template Injection SSTI issue exists in the get address display method. This function uses frappe.render template with a context from the address dict parameter, which can be a...

The vulnerability of the IntraService customer interaction system, related to bypassing authentication by using a user-controlled key, allows attackers to influence the integrity of protected information.

The vulnerability of the IntraService customer interaction system relates to the bypassing of authentication procedures by using a key controlled by the user. Exploiting this vulnerability allows a malicious actor to remotely influence the integrity of the protected information...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to bypassing authentication by using a user-controlled key, allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Git-based software platform for collaborative code development on GitLab relates to bypassing authentication by using a user-controlled key. Exploiting this vulnerability allows a malicious actor, operating remotely, to disclose sensitive information by sending specially...

Authorization Bypass

Jenkins Nexus Task Runner Plugin is vulnerable to an Authorization Bypass. The vulnerability is due to a missing permission check, allowing attackers with only Overall/Read permission to force the plugin to connect to an attacker-controlled URL using attacker-supplied credentials, potentially...

Authorization Bypass

Jenkins OpenTelemetry Plugin is vulnerable to Authorization Bypass. The vulnerability is due to the plugin allows users with only Overall/Read permission to invoke functionality that connects to attacker-specified URLs using attacker-controlled credential IDs, and enables attackers to capture or...

Cross-site Request Forgery (CSRF)

org.jenkins-ci.plugins, themis is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to insufficient validation of user requests, which allows an attacker to trick users into initiating connections to an attacker-controlled HTTP server...

CVE-2025-13124

Authorization Bypass Through User-Controlled Key vulnerability in Netiket Information Technologies Ltd. Co. ApplyLogic allows Exploitation of Trusted Identifiers. This issue affects ApplyLogic: through 01.12.2025...

CVE-2025-13003

Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc. AxOnboard allows Exploitation of Trusted Identifiers.This issue affects AxOnboard: from 3.2.0 before 3.3.0...

EUVD-2025-203066

Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1. Users are encouraged to upgrade to version 1.13.0, the latest release...