CVE-2025-25968

DDSN Interactive cm3 Acora CMS 10.1.1 contains an improper access-control vulnerability. An editor-privileged user can bypass controls by force-browsing the endpoint and abusing the file parameter (e.g., cm3.xml) to access sensitive information such as system administrator credentials, enabling a...

CVE-2025-25968

DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files...