4 matches found
CVE-2025-26347
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests...
CVE-2025-26347
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests...
CVE-2025-26347
CVE-2025-26347 affects Q-Free MaxTime (MaxTime Suite) ≤ 2.11.0. The vulnerability is in maxprofile/menu/routes.lua and is due to a missing authentication for a critical function (CWE-306). An unauthenticated remote attacker can edit user permissions via crafted HTTP requests, with CVSS 3.1 base s...
CVE-2025-26347
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests...