34308 matches found
CVE-2025-11924
The CVE-2025-11924 entry concerns Ninja Forms – The Contact Form Builder That Grows With You for WordPress (versions up to and including 3.13.2). Affected component: the ninja-forms-views REST endpoints. Root cause: insufficient authorization checks allow an unauthenticated attacker to read arbit...
📄 Institute Admission Software 2.5 Insecure Direct Object Reference
Institute Admission Software version 2.5 suffers from an insecure direct object reference vulnerability. ============================================================================================================================================= | Title : Institute Admission Software 2.5 IDOR...
PT-2025-51863
RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords...
CVE-2025-34436: Authorization Bypass Through User-Controlled Key
AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks...
Gladinet CentreStack < 16.4.10315.56368 Insecure Deserialization
According to its banner, the version of Gladinet CentreStack running on the remote host is prior to 16.4.10315.56368. It is, therefore, affected by an Insecure Deserialization due to the CentreStack portal's use an hardcoded machineKey. Note that the scanner has not tested for these issues but ha...
CVE-2025-67168
RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords...
ProjectSend 安全漏洞
ProjectSend cFTP is the ProjectSend open source suite of self-hosted applications based on PHP and MySQL. A security vulnerability exists in ProjectSend r1605 that originates from an unauthenticated attacker who can download private files by manipulating the download ID parameter, which could lea...
PT-2025-51843
Name of the Vulnerable Software and Affected Versions Portrait Dell Color Management application version 3.3.8 Description The Portrait Dell Color Management application for Dell monitors exhibits Insecure Permissions. Recommendations At the moment, there is no information about a newer version...
CVE-2025-53398
The Portrait Dell Color Management application (version 3.3.8 ) for Dell monitors is affected by a vulnerability involving Insecure Permissions . Specifically, the software creates a temporary folder with improperly set permissions when a custom installation path is utilized. This flaw can be exp...
CVE-2025-34438: Authorization Bypass Through User-Controlled Key
AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video...
CVE-2025-53398
The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,...
Pagekit 安全漏洞
Pagekit is a modular, lightweight CMS Content Management System from Pagekit Open Source. A security vulnerability exists in Pagekit version 1.0.18, which stems from the presence of an insecure direct object reference that could lead to elevation of privilege...
PT-2025-51846
Name of the Vulnerable Software and Affected Versions Pagekit CMS version 1.0.18 Description An Insecure Direct Object Reference IDOR exists in Pagekit CMS version 1.0.18, potentially allowing attackers to escalate privileges. An IDOR occurs when an application uses user-supplied input to directl...
PT-2025-51888
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 AVideo versions prior to 20.0 Description AVideo versions prior to 20.1 have a flaw where authenticated users can upload files into directories owned by other users. This is due to an insecure direct object...
PT-2025-51890
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 Description AVideo versions prior to 20.1 contain an insecure direct object reference issue. Users with upload permissions can modify the rotation metadata of any video. The ''/video/id'' endpoint verifies upload...
CVE-2025-53398: Incorrect Default Permissions
The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,...
VulnCheck KEV: CVE-2025-11924
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the ninja-forms-views REST endpoints...
RiteCMS 安全漏洞
RiteCMS is an open source content management system based on php and sqlite. An unspecified vulnerability exists in RiteCMS that stems from the use of insecure encryption to store passwords. No detailed vulnerability details are provided at this time...
PT-2025-51887
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 Description AVideo versions prior to 20.1 are susceptible to an insecure direct object reference IDOR that permits any authenticated user to delete media files owned by other users. The affected endpoint confirms...