CVE-2012-1635

The hooknodeaccess function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML...

GitLab 18.0 < 18.0.1 (CVE-2025-1110)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query...

CVE-2009-2077

Drupal 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to bypass access restrictions and 1 read unpublished content from anonymous users when a view is already configured to display the content, and 2 read private content in generated queries...

CVE-2025-48011

CVE-2025-48011 affects the Drupal One Time Password module. The connected documents specify an authentication bypass in the module, caused by a vulnerability in the Drupal One Time Password implementation that allows bypassing authentication via an alternate path or channel. Affected versions are...

CVE-2025-48011 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0...

PT-2025-26325 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.5 Mattermost versions 9.11.x through 9.11.15 Mattermost versions 10.8.x through 10.8.0 Mattermost versions 10.7.x through 10.7.2 Mattermost versions 10.6.x through 10.6.5 Description: The issue arises...

CVE-2025-4364

CVE-2025-4364 affects Assured Telematics Fleet Management System (IoT fleet solution). The connected documents describe an unauthenticated access vulnerability that could disclose system information and enable access to administrative credentials. The primary sources (CISA ICS advisory ICSA-25-14...

CVE-2025-39460 WordPress Eduma theme <= 5.6.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThimPress Eduma eduma allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eduma: from n/a through = 5.6.4...

CVE-2025-48242

Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through = 1.4.5...

Adobe ColdFusion Improper Access Control Vulnerability (CNVD-2025-10394)

Adobe ColdFusion is a Server software developed by Adobe for creating and deploying Internet applications. Adobe ColdFusion suffers from an Improper Access Control vulnerability that stems from the system failing to properly restrict access to the file system. No details of the vulnerability are...

CVE-2025-31065 WordPress Rozario <= 1.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: from n/a through 1.4...

CVE-2025-31630

CVE-2025-31630 pertains to the WordPress theme The Business (versions up to 1.6.1). The vulnerability is described as Missing Authorization, arising from incorrectly configured access control security levels. Public-facing details in connected documents indicate impact is limited to unauthenticat...

CVE-2025-32180 WordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mojofywp Product Carousel For WooCommerce – WoorouSell woorousell allows Stored XSS.This issue affects Product Carousel For WooCommerce – WoorouSell: from n/a through = 1.1.0...

CVE-2025-48127 WordPress Push notification for Mobile and Web app <= 2.0.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Push notification for Mobile and Web app: from n/a through 2.0.3...

PT-2025-21709 · Romancode · Mapsvg

Name of the Vulnerable Software and Affected Versions: MapSVG versions prior to 8.5.32 Description: The issue is related to a Missing Authorization vulnerability in RomanCode MapSVG, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions prior...

PT-2025-21585 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip versions 10.0 through 10.2 Description: The issue concerns the "Who can create public channels" access control mechanism in Zulip, which can be circumvented by creating a private or web-public channel and then changing the channel priva...

Samsung PENUP Access Control Error Vulnerability

Samsung PENUP is a digital painting application from the South Korean company Samsung SAMSUNG. Samsung PENUP is vulnerable to an Access Control Error vulnerability that stems from improper access control, no details of the vulnerability are provided at this time...

Cisco IOS Access Control Error Vulnerability (CNVD-2025-15478)

Cisco IOS is the United States Cisco Cisco company's set of operating system developed for its network equipment. Cisco IOS suffers from an Access Control Error vulnerability that stems from a misconfiguration of access control lists, which can be exploited by an attacker to cause bypassing of AC...

CVE-2025-30326 Photoshop Desktop | Access of Uninitialized Pointer (CWE-824)

Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2025-20850 · Siemens · Sirius 3Rk3 Modular Safety System +1

Name of the Vulnerable Software and Affected Versions: SIRIUS 3RK3 Modular Safety System MSS All versions SIRIUS Safety Relays 3SK2 All versions Description: A vulnerability has been identified where the affected devices do not require authentication to access critical resources. An attacker with...