CVE-2025-44109

CVE-2025-44109 describes a URL redirection vulnerability in Pinokio v3.6.23 that can redirect victim users to attacker-controlled pages. Affected software: Pinokio Desktop (v3.6.23); underlying issue attributed to the URL redirection feature. Impact per CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A...

CVE-2025-50477

A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages...

CVE-2025-50477

CVE-2025-50477 describes a URL redirection vulnerability in lbry-desktop version 0.53.9. The issue arises from the URL redirection feature, enabling an attacker to redirect users to attacker-controlled pages. Documented impact is user redirection with low confidentiality and availability impact, ...

CVE-2025-44109

A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages...

CVE-2025-50477

A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the downloadFile function in the ModuleController.php file, which fails to validate the query parameter file. An authenticated attacker with access to the backend module can access...

Authorization Bypass Through User-Controlled Key

Overview in2code/femanager is a Modern TYPO3 Frontend User Registration. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the identity parameter when saving user-submitted data. An attacker can gain unauthorized access and modify sensitive...

CVE-2025-6585

The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the csremoveprofilecallback function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-4129

Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay: before 13.05.2025...

CVE-2025-4129 IDOR in PAVO Inc.'s PAVO Pay

Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay: before 13.05.2025...

CVE-2025-4129 IDOR in PAVO Inc.'s PAVO Pay

Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay: before 13.05.2025...

CVE-2025-4040

Authorization Bypass Through User-Controlled Key vulnerability in Turpak Automatic Station Monitoring System allows Privilege Escalation. This issue affects Automatic Station Monitoring System: before 5.0.6.51...

CVE-2025-2301

Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers. This issue affects Online Exam Registration: before 14.03.2025...

CVE-2025-5681

Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 23.06.2025...

CVE-2025-5681

Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 23.06.2025...

CVE-2025-1469

Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 11.03.2025...

CVE-2025-1469 IDOR in Turtek Software's Eyotek

Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 11.03.2025...

CVE-2025-1469

CVE-2025-1469 is an Authorization Bypass in Turtek Software Eyotek. Affected product: Eyotek before 11.03.2025. Root cause described in sources as bypass via a user-controlled key enabling exploitation of trusted identifiers. Impact is consistent with a high-severity CVSS 3.1 vector (Network atta...

CVE-2025-1469

Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 11.03.2025...

Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering

Summary A remote script-inclusion / stored XSS vulnerability in @nuxtjs/mdc lets a Markdown author inject a element. The tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and...