SinoTrack GPS Receiver

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to access device profiles for which they are not authorized through the common web management interface. Access to the device profile may allow an attacker to perform some remote functions on connected...

PT-2025-24580 · Amd · Amd Versal Adaptive Soc

Name of the Vulnerable Software and Affected Versions: AMD Versal Adaptive SoC devices affected versions not specified Description: The issue arises from the lack of address validation when executing PLM runtime services through the PLM firmware, allowing access to isolated or protected memory...

CVE-2025-30927

Missing Authorization vulnerability in Wordapp Team Wordapp wordapp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordapp: from n/a through = 1.7.0...

CVE-2025-49287

Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through = 2.2.8...

CVE-2025-24762 WordPress TicketBAI Facturas para WooCommerce <= 3.19 - Broken Access Control Vulnerability

Missing Authorization vulnerability in facturaone TicketBAI Facturas para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects TicketBAI Facturas para WooCommerce: from n/a through 3.19...

CVE-2025-30927

CVE-2025-30927 (Wordapp, WordPress): Missing Authorization due to incorrectly configured access control affects Wordapp plugin versions up to 1.7.0. CVSS 3.1/4.3 (Base 4.3; Network attack vector, Low complexity, Privileges Required: Low, No user interaction; Confidentiality impact: Low). The conn...

CVE-2025-49320 WordPress FraudLabs Pro for WooCommerce plugin <= 2.22.11 - Broken Access Control Vulnerability

Missing Authorization vulnerability in fraudlabspro FraudLabs Pro for WooCommerce fraudlabs-pro-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FraudLabs Pro for WooCommerce: from n/a through = 2.22.11...

CVE-2025-49270 WordPress WP-CRM System <= 3.4.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Mario Peshev WP-CRM System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-CRM System: from n/a through 3.4.2...

CVE-2025-49240

CVE-2025-49240 (DocsPress): Missing Authorization in DocsPress ≤ 2.5.2 due to misconfigured access control. Impact per sources is unauthorized access to or manipulation of resources governed by access levels. Remediation: update DocsPress to 2.5.2 or newer where patched.

CVE-2024-13967

This vulnerability allows the successful attacker to gain unauthorized access to a configuration web page delivered by the integrated web Server of EIBPORT. This issue affects EIBPORT V3 KNX: through 3.9.8; EIBPORT V3 KNX GSM: through 3.9.8...

Mattermost has an unspecified vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from improperly invalidated personal access tokens, which can be exploited by an attacker to maintain full system access...

PT-2025-24215 · Mario Peshev · Wp-Crm System

Name of the Vulnerable Software and Affected Versions: Mario Peshev WP-CRM System versions 3.4.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by Access Control Lists ACLs. This means that...

WordPress WP-CRM System plugin <= 3.4.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Mika in WordPress Plugin WP-CRM System versions = 3.4.2...

CVE-2024-13967

Summary: CVE-2024-13967 affects BAB TECHNOLOGIE EIBPORT V3 KNX and V3 KNX GSM up to version 3.9.8. The issue allows an attacker to gain unauthorized access to the device’s configuration web page served by the integrated web server. Affected products/versions (as stated in connected sources): EIBP...

CVE-2024-13967 ession-Management Failure

This vulnerability allows the successful attacker to gain unauthorized access to a configuration web page delivered by the integrated web Server of EIBPORT. This issue affects EIBPORT V3 KNX: through 3.9.8; EIBPORT V3 KNX GSM: through 3.9.8...

Grafana 12.0.x < 12.0.1 Improper Access Control

According to its self-reported version, the Grafana install hosted on the remote host is earlier than 10.4.19, or 11.2.x earlier than 11.2.10, or 11.3.x earlier than 11.3.7, or 11.4.x earlier than 11.4.5, or 11.5.x earlier than 11.5.5, or 11.6.x earlier than 11.6.2, or 12.0.x earlier than 12.0.1...

CVE-2025-45387

osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php...

CVE-2025-45387

osTicket is affected in versions prior to 1.17.6 and prior to 1.18.2 by a Broken Access Control vulnerability in the /scp/ajax.php endpoint. The issue, described across multiple sources, implies restricted authorization checks could be bypassed, potentially permitting unintended access. Public de...

CVE-2025-45387

osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php...

PT-2025-23436 · Unknown · Mist Community Edition

Name of the Vulnerable Software and Affected Versions: Mist Community Edition versions up to 4.7.1 Description: A critical issue has been found, affecting the create token function of the API Token Handler component. This leads to improper access controls, allowing remote attacks. The issue has...