CVE-2025-46387

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-46386

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-46387

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-46387

CVE-2025-46387 describes an authorization bypass in Emby MediaBrowser (a media server) via a user-controlled key (CWE-639). The vulnerability is documented across multiple feeds (NVD/NVD-derived, CNVD, ENISA ENISA EUVD, CCTV-like references), consistently noting an authorization bypass mechanism ...

CVE-2025-46387

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-46386

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-46386

CVE-2025-46386 corresponds to a CWE-639 authorization bypass via a user-controlled key. Connected sources identify the affected software as Emby MediaBrowser (and related mentions), noting that the issue enables bypassing authentication through manipulation of a user-controlled key. The Red Hat/C...

CVE-2025-46386

CWE-639 Authorization Bypass Through User-Controlled Key...

CVE-2025-32430

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute...

PT-2025-32151 · Emby · Mediabrowser

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: This issue involves an authorization bypass through a user-controlled key. Recommendations: At the moment, there is no information about a newer version that...

PT-2025-32153 · Emby · Mediabrowser

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: This issue involves an authorization bypass through a user-controlled key. Recommendations: At the moment, there is no information about a newer version that...

EDK2 SMM MCE Enablement Issue

Summary A researcher reported a bug in the open source EDK2 system management interrupt SMI entry code when an MCE occurs near the start of the SMI handler. An attacker who can inject a machine check exception MCE could cause execution to jump to an attacker-controlled interrupt handler, leading ...

GLSA-202508-06 : Composer: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202508-06 Composer: Multiple Vulnerabilities Integrators using Composer code to call VcsDriver::getFileContent can have a code injection vulnerability if the user can control the $file or $identifier argument. This leads to a...

CVE-2025-32430

CVE-2025-32430 – XWiki Platform Reflected XSS . Affected: XWiki Platform versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5, and 17.0.0-rc-1 through 17.2.2. Issue: two templates contain reflected XSS allowing attacker-controlled URLs to execute JavaScript in the victim’s session...

GHSA-VF2R-CXG9-P7RF The ADOdb sqlite3 driver allows SQL injection

Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a sqlite3 database and calls the metaColumns, metaForeignKeys or metaIndexes methods with a crafted table name. Note that the indicated Severity corresponds to a...

CVE-2025-54132

CVE-2025-54132 affects Cursor’s Mermaid-based diagram tool prior to version 1.3. An attacker can trigger prompt injections to cause Mermaid-rendered images to fetch data to a remote attacker-controlled server, enabling exfiltration of sensitive information. The issue is fixed in version 1.3; upgr...

CVE-2025-54564

uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user...

CVE-2025-54564

The CVE-2025-54564 entry affects ChargePoint Home Flex 5.5.4.13. It stems from the uploadsm component failing to validate a user-controlled string during bz2 decompression, enabling command execution as the nobody user. According to the initial data, this is a local vulnerability with a CVSS 3.1 ...

CVE-2025-40600

Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption...

GHSA-JGMV-J7WW-JX2X Koa Open Redirect via Referrer Header (User-Controlled)

Summary In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target. Details on the API document https://www.koajs.net/api/responseresponseredirecturl-alt, we can see:...