CVE-2025-5390

CVE-2025-5390 targets JeeWMS up to 20250504, affecting the File Handler’s function filedeal in the file path /systemController/filedeal.do . The vulnerability causes improper access controls and can be exploited remotely. Several connected sources corroborate the affected scope and remote risk, w...

CVE-2025-5389 JeeWMS File generateController.do dogenerateOne2Many access control

A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the file /generateController.do?dogenerateOne2Many of the component File Handler. The manipulation leads to improper access controls. The attack...

CVE-2025-5389

JeeWMS up to 20250504 is affected by a vulnerability in the File Handler component: the function dogenerateOne2Many within /generateController.do?dogenerateOne2Many suffers from improper access controls, enabling remote exploitation. Multiple sources (NVD, Red Hat, CVE lists, PT-2025-23414) confi...

PT-2025-23412 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS up to 20250504 Description: A critical issue has been discovered, affecting the dogenerate function of the /generateController.do?dogenerate file in the File Handler component. This leads to improper access controls, allowing remote...

PT-2025-23334 · Unknown · Application-Urlshortener

Name of the Vulnerable Software and Affected Versions: application-urlshortener versions prior to 1.2.4 Description: The issue allows users with view access to create arbitrary pages, including guest users who do not have existing accounts. This can lead to the creation of a large number of pages...

Instantel Micromate (Update A)

RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to access the device's configuration port and execute commands. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability,...

PT-2025-23035 · Unknown +1 · Net-Cidr-Lite +2

Name of the Vulnerable Software and Affected Versions: Net::CIDR::Set versions 0.10 through 0.13 Description: The issue arises from the improper handling of leading zero characters in IP CIDR address strings, potentially allowing attackers to bypass access control based on IP addresses. This is d...

PT-2025-22900 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: A missing authorization vulnerability in TCMAN's GIM allows an authenticated attacker to access any functionality of the application, even when they are not available through the user interface. To exploit...

CVE-2025-46488 WordPress Visual Builder plugin <= 1.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in dastan800 Visual Builder visual-builder allows Reflected XSS.This issue affects Visual Builder: from n/a through = 1.2.2...

CVE-2025-23684

Missing Authorization vulnerability in Eugen Bobrowski Debug Tool debug-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Debug Tool: from n/a through = 2.2...

CVE-2024-47771

Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involvi...

CVE-2024-47294

Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2024-44913

An issue in the component EXR!ReadEXR+0x40ef1 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability can lead to a Denial of Service DoS...

CVE-2024-3270

A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may ...

CVE-2024-28215

nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...

CVE-2024-7554

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versions starting from 17.2 before 17.2.2. Under certain conditions, access tokens may have been logged when an API request was made in a specif...

CVE-2024-25251

code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control...

CVE-2024-54096

Vulnerability of improper access control in the MTP module Impact: Successful exploitation of this vulnerability may affect integrity and accuracy...

CVE-2024-27930

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13...

CVE-2024-45805

OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information SETTINGSSUPPORT. This is due to inadequate access control for support information...