6 matches found
CVE-2025-26345
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests...
CVE-2025-26345
creationtimestamp| type| source ---|---|--- 2025-02-12 14:20:50+00:00| seen| https://infosec.exchange/users/cve/statuses/113991355626218184 2025-02-12 14:48:34+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/113991464633045244 2025-02-12 15:09:28+00:00| seen|...
CVE-2025-26345
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests...
CVE-2025-26345
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests...
CVE-2025-26345
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests...
CVE-2025-26345
CVE-2025-26345 affects Q-Free MaxTime ≤ 2.11.0. A CWE-306 vulnerability in maxprofile/menu/routes.lua allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests. The issue is described as critical (CVSS 3.1: 9.8, Network, No Privileges) with no explicit rem...