The vulnerability of the N8n automation platform, related to insufficient control over resources with dynamic management, allows a perpetrator to gain unauthorized access to the platform.

The vulnerability of the N8n automation platform lies in the insufficient control over resources with dynamic management. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to the platform...

CVE-2025-62955

CVE-2025-62955 is a vulnerability affecting HappyDevs TempTool (WordPress plugin) up to version 1.3.1, described as Exposure of Sensitive System Information to an Unauthorized Control Sphere, allowing retrieval of embedded sensitive data. Public references from multiple sources (NVD, Red Hat, EUV...

CVE-2025-62955 WordPress TempTool [Show Current Template Info] plugin <= 1.3.1 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HappyDevs TempTool Show Current Template Info current-template-name allows Retrieve Embedded Sensitive Data.This issue affects TempTool Show Current Template Info: from n/a through = 1.3.1...

CVE-2025-62955 WordPress TempTool [Show Current Template Info] plugin <= 1.3.1 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HappyDevs TempTool Show Current Template Info current-template-name allows Retrieve Embedded Sensitive Data.This issue affects TempTool Show Current Template Info: from n/a through = 1.3.1...

EUVD-2025-204663

Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances...

CVE-2025-68644

Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances...

CVE-2025-13361 Web to SugarCRM Lead <= 1.0.0 - Cross-Site Request Forgery to Custom Field Deletion

The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the custom field deletion functionality. This makes it possible for unauthenticated attackers to delete custom fields v...

CVE-2025-68644

Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances...

CVE-2025-68644

Yealink RPS before 2025-06-27 allows unauthorized access to information (including AutoP URL addresses) due to an inadequate authentication mechanism. A security update deploying an enhanced authentication mechanism to all cloud instances fixes the issue. Affected product: Yealink RPS prior to 20...

PT-2025-52578

Name of the Vulnerable Software and Affected Versions Yealink RPS versions prior to 2025-06-27 Description The Yealink RPS software contains a flaw that allows unauthorized access to information, including AutoP URL addresses. The issue was addressed by implementing a more robust authentication...

PT-2025-52568

Name of the Vulnerable Software and Affected Versions HappyFiles Pro versions through 1.8.1 Description An authorization issue exists in HappyFiles Pro, allowing exploitation of incorrectly configured access control security levels. This can lead to unauthorized access. Recommendations Update...

PT-2025-52567

Name of the Vulnerable Software and Affected Versions HappyFiles Pro versions through 1.8.1 Description An authorization issue exists in HappyFiles Pro, allowing exploitation due to incorrectly configured access control security levels. This can lead to unauthorized access. Recommendations Update...

Yealink RPS 安全漏洞

Yealink RPS is a redirection and configuration service software from China Yealink Yealink. A security vulnerability exists in Yealink RPS versions prior to 2025-06-27, which stems from a flaw in the unauthorized access mechanism that could lead to information disclosure...

PT-2025-52573

Name of the Vulnerable Software and Affected Versions Tainacan plugin for WordPress versions up to and including 1.0.1 Description The Tainacan plugin for WordPress has a flaw where unauthorized metadata sections can be created. This is because the create item permissions check function always...

CVE-2025-58052

Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires...

CVE-2024-49587

Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed...

CVE-2025-14882

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

CVE-2025-12361

The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

EUVD-2025-204627

The F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'filedownload' function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to download any file from the WordPre...

SUSE CVE-2025-63389

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations...