PT-2025-18005 · Iteachyou · Iteachyou Dreamer Cms

Name of the Vulnerable Software and Affected Versions: iteachyou Dreamer CMS versions up to 4.1.3 Description: A vulnerability was found in the Attachment Handler component, specifically affecting an unknown functionality of the file /admin/attachment/download. The manipulation of the ID argument...

wowjoy Internet Doctor Workstation System 安全漏洞

The wowjoy Internet Doctor Workstation System is a medical system from the Chinese company wowjoy. A security vulnerability exists in version 1.0 of the wowjoy Internet Doctor Workstation System that originates from improper authorization in file /v1/prescription/list...

PT-2025-18008 · Wowjoy 浙江湖州华卓信息科技有限公司 · Internet Doctor Workstation System

Name of the Vulnerable Software and Affected Versions: wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System version 1.0 Description: A problematic vulnerability was found in the Internet Doctor Workstation System, affecting unknown code of the file /v1/prescription/list, leading to improper...

CVE-2025-2850

A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT250...

CVE-2025-2850 GL.iNet GL-A1300 Slate Plus Download Interface improper authorization

A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT250...

CVE-2025-2850

CVE-2025-2850 concerns GL.iNet router firmware Download Interface across multiple models (e.g., GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR750 Creta, GL-AX1800 Flint, GL-MT300N-V2 Mango, GL-XE3000 Puli AX, etc.). Connected sources describe a vulnerability in the Download Interface component wh...

CVE-2025-2850 GL.iNet GL-A1300 Slate Plus Download Interface improper authorization

A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT250...

CVE-2025-3838

An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed...

GL.iNet Router 安全漏洞

GL.iNet Router is a series of routers from China's Guanglian Zhitong GL.iNet company. A security vulnerability exists in GL.iNet Router that originates from improper authorization of the download interface component...

PT-2025-17955 · Gl.Inet · Gl.Inet Router Firmware

Name of the Vulnerable Software and Affected Versions: GL.iNet router firmware versions 4.x Description: A vulnerability was found in the Download Interface component of the GL.iNet router firmware, affecting some unknown processing. The manipulation leads to improper authorization...

CVE-2024-49808

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions...

CVE-2025-42605

This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modification, or cancellation operations. An authenticated remote attacker could exploit this vulnerability by manipulating parameter in the API request body to...

SAP NetWeaver Visual Composer Metadata Uploader Improper Authorization (CVE-2025-31324) (Direct Check)

Binary data sapnetweaverCVE-2025-31324.nbin...

CVE-2025-31324

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availabili...

Improper Authorization

github.com/nats-io/nats-server is vulnerable to Improper Authorization. The vulnerability is due to missing access restrictions due to certain JetStream management API requests lacking proper access controls, allowing unauthorized administrative actions across accounts...

PT-2025-17604

Name of the Vulnerable Software and Affected Versions Grafana version 10.4.0 Description The issue concerns improper authorization in the Data Source Proxy API. Recommendations For Grafana version 10.4.0, update to a version that includes the fix for this issue. At the moment, there is no...

Meon Bidding 安全漏洞

Meon Bidding is a bidding related solution from Meon India. Meon Bidding has a security vulnerability that stems from improper authorization controls on certain API endpoints, which could lead to unauthorized access to other user accounts...

CVE-2025-2298

An improper authorization vulnerability in Dremio Software allows authenticated users to delete arbitrary files that the system has access to, including system files and files stored in remote locations such as S3, Azure Blob Storage, and local filesystems. This vulnerability exists due to...

CVE-2025-2298 Authenticated API Endpoint Allows Arbitrary File Deletion in Dremio Software

An improper authorization vulnerability in Dremio Software allows authenticated users to delete arbitrary files that the system has access to, including system files and files stored in remote locations such as S3, Azure Blob Storage, and local filesystems. This vulnerability exists due to...

CVE-2025-2298

CVE-2025-2298 is an improper authorization vulnerability in Dremio Software where authenticated users can delete arbitrary files across local and remote locations due to insufficient API endpoint access controls. Impact includes potential data loss and DoS, with possible escalation depending on d...