CVE-2025-34435 AVideo < 20.1 IDOR Arbitrary File Deletion

AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference IDOR that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video...

CVE-2025-34435 AVideo < 20.1 IDOR Arbitrary File Deletion

AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference IDOR that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video...

CVE-2025-34436 AVideo < 20.1 IDOR Arbitrary File Upload

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks...

CVE-2025-34436 AVideo < 20.1 IDOR Arbitrary File Upload

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks...

CVE-2025-34436

AVideo is affected by an IDOR in the file upload feature: versions prior to 20.1 allow any authenticated user to upload files into directories owned by other users because ownership checks are not enforced, despite authentication being required. The issue stems from lack of authorization for the ...

CVE-2025-67168

RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords...

EUVD-2025-203898

The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,...

CVE-2025-67165

An Insecure Direct Object Reference IDOR in Pagekit CMS v1.0.18 allows attackers to escalate privileges...

CVE-2025-53398

The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,...

CVE-2025-53398

The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,...

CVE-2025-66165

Missing Authorization vulnerability in merkulove Lottier for WPBakery lottier-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier for WPBakery: from n/a through = 1.1.7...

EUVD-2025-203882

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the ninja-forms-views REST endpoints...

CVE-2025-11924

The CVE-2025-11924 entry concerns Ninja Forms – The Contact Form Builder That Grows With You for WordPress (versions up to and including 3.13.2). Affected component: the ninja-forms-views REST endpoints. Root cause: insufficient authorization checks allow an unauthenticated attacker to read arbit...

📄 Institute Admission Software 2.5 Insecure Direct Object Reference

Institute Admission Software version 2.5 suffers from an insecure direct object reference vulnerability. ============================================================================================================================================= | Title : Institute Admission Software 2.5 IDOR...

PT-2025-51863

RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords...

CVE-2025-34436: Authorization Bypass Through User-Controlled Key

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks...

Gladinet CentreStack < 16.4.10315.56368 Insecure Deserialization

According to its banner, the version of Gladinet CentreStack running on the remote host is prior to 16.4.10315.56368. It is, therefore, affected by an Insecure Deserialization due to the CentreStack portal's use an hardcoded machineKey. Note that the scanner has not tested for these issues but ha...

ProjectSend 安全漏洞

ProjectSend cFTP is the ProjectSend open source suite of self-hosted applications based on PHP and MySQL. A security vulnerability exists in ProjectSend r1605 that originates from an unauthenticated attacker who can download private files by manipulating the download ID parameter, which could lea...

PT-2025-51843

Name of the Vulnerable Software and Affected Versions Portrait Dell Color Management application version 3.3.8 Description The Portrait Dell Color Management application for Dell monitors exhibits Insecure Permissions. Recommendations At the moment, there is no information about a newer version...

CVE-2025-53398

The Portrait Dell Color Management application (version 3.3.8 ) for Dell monitors is affected by a vulnerability involving Insecure Permissions . Specifically, the software creates a temporary folder with improperly set permissions when a custom installation path is utilized. This flaw can be exp...