Authentication Bypass
Monthly
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit ddb439f8eb1816010f2ef653a908648b71f9bba8.
A security vulnerability in FortiOS (CVSS 5.3) that allows a remote unauthenticated user. Remediation should follow standard vulnerability management procedures.
Unrestricted file upload in Staff Audit System 1.0 allows remote attackers to upload arbitrary files via the /test.php endpoint, leading to potential remote code execution. Exploit code is publicly available, but no active exploitation or KEV listing has been confirmed. The vulnerability is critical as it may bypass authentication entirely.
Cryptographic issue occurs due to use of insecure connection method while downloading.
Unrestricted file upload in code-projects E-Commerce Site 1.0 allows authenticated attackers to upload arbitrary PHP files via the photo parameter in /admin/users_photo.php, potentially leading to remote code execution on the server. Public exploit code is available, increasing immediate risk for instances where the admin panel is exposed.
A security vulnerability in A vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application exposes an endpoint that allows an unauthorized modification of administrative credentials. This could allow an unauthenticated attacker to reset the superadmin password and gain full control of the application (ZDI-CAN-26569).
A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application allows low-privileged users to trigger installations by overwriting cache files and modifying the downloads path. This would allow an attacker to escalate privilege and exceute arbitrary code.
Improper authorization in accessing saved Wi-Fi password for Galaxy Tablet prior to SMR Jul-2025 Release 1 allows secondary users to access owner's saved Wi-Fi password.
CVE-2025-7346 is a security vulnerability (CVSS 8.7). High severity vulnerability requiring prompt remediation.
An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.
A security vulnerability in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application.
CVE-2025-42974 is a security vulnerability (CVSS 4.3) that allows access. Remediation should follow standard vulnerability management procedures.
SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application.
Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient validation of user permissions to access sensitive database tables. By leveraging overly permissive access configurations, unauthorized reading of critical data is possible, resulting in a significant impact on the confidentiality of the information stored. However, the integrity and availability of the system remain unaffected.
CVE-2025-42960 is a security vulnerability (CVSS 4.3) that allows an authenticated attacker. Remediation should follow standard vulnerability management procedures.
CVE-2025-42953 is a security vulnerability (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A security vulnerability in SAP Business Warehouse and SAP Plug-In Basis (CVSS 7.7) that allows an authenticated attacker. High severity vulnerability requiring prompt remediation.
Unrestricted file upload in Advanced Online Voting System 1.0's /admin/candidates_add.php endpoint allows remote authenticated attackers (low privileges) to upload arbitrary files via the photo parameter. Public exploit code is available, but EPSS indicates low exploitation probability (0.10%) and no active exploitation is confirmed. The vulnerability could lead to code execution if a malicious PHP file is uploaded.
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially enabling remote code execution. A public proof-of-concept exploit is available, and the vulnerability is rated critical although the CVSS 4.0 base score suggests low impact. No active exploitation has been confirmed.
An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical attacker to bypass the lock screen and access user files by removing the stylus while the device is closed and using the screen capture feature.
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite [system source type](https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.2/configure-source-types/create-source-types) configurations by sending a specially-crafted payload to the `/servicesNS/nobody/search/admin/sourcetypes/` REST endpoint on the Splunk management port.
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn off the scheduled search `Bucket Copy Trigger` within the Splunk Archiver application. This is because of missing access controls in the saved searches for this app.
In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles, and has read-only access to a specific alert, could suppress that alert when it triggers. See [Define alert suppression groups to throttle sets of similar alerts](https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.4/manage-alert-trigger-conditions-and-throttling/define-alert-suppression-groups-to-throttle-sets-of-similar-alerts).
A security vulnerability in giscus (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. The firmware file, rootfs.tar.gz, contains hard-coded credentials for the Twilio API. A remote attacker who obtains a copy of the firmware can extract these credentials. This could allow the attacker to gain unauthorized access to the associated Twilio account, leading to information disclosure, potential service disruption, and unauthorized use of the Twilio services.
An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB Server v8.0 versions prior to 8.0.7, MongoDB Server v7.0 versions prior to 7.0.19 and MongoDB Server v6.0 versions prior to 6.0.22
Unrestricted file upload in Online Note Sharing 1.0 allows authenticated attackers to upload arbitrary files via the profile image handler, potentially leading to remote code execution. The vulnerability exists in the /
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.
CVE-2025-3466 is a security vulnerability (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.
A security vulnerability in A vulnerability (CVSS 8.5). High severity vulnerability requiring prompt remediation.
A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the function PUT of the file apps/rowboat/app/api/uploads/[fileId]/route.ts of the component Session Handler. The manipulation of the argument params leads to missing authentication. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is expected that this issue will be fixed in the near future.
Missing authentication in the file upload API endpoint of SimStudioAI Sim allows remote unauthenticated attackers to upload arbitrary files. The vulnerability affects all versions up to commit 37786d371e17d35e0764e1b5cd519d873d90d97b. Public exploit code is available, though no active exploitation in the wild has been confirmed (not listed in CISA KEV).
Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this vulnerability may allow the peer device to use the camera without user awareness.
CVE-2025-53168 is a security vulnerability (CVSS 5.7) that allows the peer device. Remediation should follow standard vulnerability management procedures.
Unrestricted file upload in BoyunCMS up to version 1.4.20 allows remote attackers to upload arbitrary files via the image parameter in /application/user/controller/Index.php. Exploit code is publicly available, but EPSS indicates low exploitation probability (0.08%) and no active exploitation in CISA KEV.
A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
JWT token forgery in Done-0 Jank (all rolling-release builds up to commit 322caebbad10568460364b9667aa62c3080bfc17) allows remote attackers to authenticate without valid credentials by using hardcoded signing secrets ('jank-blog-secret' and 'jank-blog-refresh-secret'). Exploit code is publicly available but active exploitation is not confirmed; EPSS (0.04%) and low CVSS indicate limited real-world risk.
Authentication bypass in bluebell-plus 2.x allows remote attackers to forge JWT tokens and gain unauthorized access by exploiting a hardcoded signing secret.
Unrestricted file upload in BlackVue DR590X dashcam firmware allows unauthenticated attackers on the local network to upload arbitrary files via the /upload.cgi HTTP endpoint, achieving full device compromise. A public proof-of-concept exploit is available, but the vendor has not responded or released a patch. The low EPSS score (0.06%) and absence from CISA KEV suggest limited real-world exploitation so far.
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.
NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions of the application, a password comparison is performed using the `==` operator at line 40 in front/index.php. This introduces a security issue where specially crafted "magic hash" values that evaluate to true in a loose comparison can bypass authentication. Because of the use of `==` instead of the strict `===`, different strings that begin with 0e and are followed by only digits can be interpreted as scientific notation (i.e., zero) and treated as equal. This issue falls under the Login Bypass vulnerability class. Users with certain "weird" passwords that produce magic hashes are particularly affected. Services relying on this logic are at risk of unauthorized access. Version 25.6.7 fixes the vulnerability.
A security vulnerability in newer MediaWiki (CVSS 7.5). High severity vulnerability requiring prompt remediation.
A security vulnerability in MbedTLS 3.3.0 (CVSS 4.9). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in pietro MobiLoud (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A security vulnerability in Missing Authorization vulnerability in vgwort VG WORT METIS (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Authenticated attackers with low privileges can exploit missing authorization checks in Paytiko for WooCommerce versions up to 1.3.14 to modify plugin data, leading to high integrity impact but no confidentiality or availability loss. The vulnerability, classified as CWE-862, has
Missing authorization in Gnuget MF Plus WPML plugin versions up to 1.1 allows unauthenticated attackers to modify settings. The vulnerability has a CVSS base score of 6.5, affecting integrity and availability without confidentiality impact, but no active exploitation is known and EPSS score (0.06%) indicates a low probability of real-world attacks.
Unauthorized settings modification in WC Pickup Store (WordPress plugin by Keylor Mendoza) versions up to 1.8.9 allows unauthenticated attackers to alter plugin configuration, potentially disrupting pickup store operations. No active exploitation (CISA KEV) or public exploit code has been identified, and EPSS probability is very low (0.06%).
A security vulnerability in Missing Authorization vulnerability in ashanjay EventON (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in amazewp fluXtore (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization check in LMSACE Connect plugin for WordPress up to version 3.4 allows authenticated low‑privilege users to bypass access controls and modify plugin data. No public exploit code or active exploitation is known, and EPSS stands at 0.04%, indicating very low immediate risk.
Missing authorization in ZoomIt WooCommerce Shop Page Builder allows authenticated attackers to bypass access controls and modify shop pages. The vulnerability affects versions up to 2.27.7 and has a low EPSS exploitation probability (0.04%), indicating no widespread exploitation is expected. No public exploit code has been identified at this time.
Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.
A security vulnerability in Booking X (CVSS 7.5). High severity vulnerability requiring prompt remediation.
A security vulnerability in plugin for WordPress is vulnerable to unauthorized post access in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators.
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $_POST['role'] and, after basic cleaning via hrm_clean(), passes it directly to wp_insert_user() and later to $user->set_role() without verifying that the current user is allowed to assign that role. This makes it possible for authenticated attackers, with Employee-level access and above, to elevate their privileges to administrator.
n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. This issue has been patched in version 1.99.1. A workaround involves restricting access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway.
Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to source code and control network, the attacker can bypass the REST interface authentication and gain access to MQTT configuration data. This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016.
Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Authorization.This issue affects Mediawiki - Scribunto Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
In Melapress File Monitor plugin for WordPress before 2.2.0, missing authorization checks allow authenticated attackers to exploit incorrectly configured access control, potentially leading to unauthorized modification of integrity or availability of monitored data. The vulnerability carries a CVSS 3.1 base score of 5.4 (medium) and has a low EPSS exploitation probability (0.06%), with no known active exploitation or public exploit code. A vendor patch in version 2.2.0 addresses the issue.
During startup, the device automatically logs in the EPC2 Windows user without requesting a password.
System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This leads to unintentional disclosure of sensitive information such as api keys, passwords, etc. A malicious actor with read access to these logs could obtain secrets and further use them to gain unauthorized access to other systems. Starting with version 4.43.0 Docker Desktop no longer logs system environment variables as part of diagnostics log collection.
CVE-2025-0885 is a security vulnerability (CVSS 1.8) that allows unauthorized access. Remediation should follow standard vulnerability management procedures.
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.
Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack.
Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication.
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.
CVE-2025-6942 is a security vulnerability (CVSS 3.8) that allows an attacker. Remediation should follow standard vulnerability management procedures.
A security vulnerability in HomeBox (CVSS 5.3) that allows authenticated users. Remediation should follow standard vulnerability management procedures.
Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System > Configuration > Users > "Allow users to create personal access tokens".
A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts within the upgrade.sh or disk image components. These modified upgrade images are not validated for authenticity or integrity, and are executed by the system post-upload, enabling root access.
A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service, responsible for integration with GFI AppManager, exposes HTTP services on ports 7995 and 7996 without proper authentication. The /proxy handler on port 7996 allows arbitrary forwarding to administrative endpoints when provided with an Appliance UUID, which itself can be retrieved from port 7995. This results in a complete authentication bypass, permitting access to sensitive administrative APIs.
An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to internal services such as GFIAgent, bypassing firewall restrictions and exposing internal management endpoints. This enables unauthenticated attackers to access the GFIAgent service on ports 7995 and 7996, retrieve the appliance UUID, and issue administrative requests via the proxy. Exploitation results in full administrative access to the Kerio Control appliance.
An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Unauthorized data modification and availability impact in Mollie Payments for WooCommerce plugin up to version 8.0.2 via missing authorization checks allows unauthenticated remote attackers to manipulate payment settings with no user interaction. Confidentiality is not impacted, and the low integrity and availability effects limit damage. No public exploit or active exploitation has been
A security vulnerability in Soumettre.fr (CVSS 3.7). Remediation should follow standard vulnerability management procedures.
The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates.
A remote code execution vulnerability (CVSS 9.8). Critical severity with potential for significant impact on affected systems.
Missing authorization in The Plus Addons for Elementor Pro allows authenticated attackers to manipulate access controls, leading to data modification and service disruption. Versions prior to 6.3.7 are affected. No known active exploitation or public exploit exists, and the EPSS probability is very low (0.06%).
A security vulnerability in is a ticket escalation process helper for GLPI. (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen and view the wallet balance.
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit ddb439f8eb1816010f2ef653a908648b71f9bba8.
A security vulnerability in FortiOS (CVSS 5.3) that allows a remote unauthenticated user. Remediation should follow standard vulnerability management procedures.
Unrestricted file upload in Staff Audit System 1.0 allows remote attackers to upload arbitrary files via the /test.php endpoint, leading to potential remote code execution. Exploit code is publicly available, but no active exploitation or KEV listing has been confirmed. The vulnerability is critical as it may bypass authentication entirely.
Cryptographic issue occurs due to use of insecure connection method while downloading.
Unrestricted file upload in code-projects E-Commerce Site 1.0 allows authenticated attackers to upload arbitrary PHP files via the photo parameter in /admin/users_photo.php, potentially leading to remote code execution on the server. Public exploit code is available, increasing immediate risk for instances where the admin panel is exposed.
A security vulnerability in A vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application exposes an endpoint that allows an unauthorized modification of administrative credentials. This could allow an unauthenticated attacker to reset the superadmin password and gain full control of the application (ZDI-CAN-26569).
A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application allows low-privileged users to trigger installations by overwriting cache files and modifying the downloads path. This would allow an attacker to escalate privilege and exceute arbitrary code.
Improper authorization in accessing saved Wi-Fi password for Galaxy Tablet prior to SMR Jul-2025 Release 1 allows secondary users to access owner's saved Wi-Fi password.
CVE-2025-7346 is a security vulnerability (CVSS 8.7). High severity vulnerability requiring prompt remediation.
An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.
A security vulnerability in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application.
CVE-2025-42974 is a security vulnerability (CVSS 4.3) that allows access. Remediation should follow standard vulnerability management procedures.
SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on confidentiality with no effect on integrity or availability of the application.
Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient validation of user permissions to access sensitive database tables. By leveraging overly permissive access configurations, unauthorized reading of critical data is possible, resulting in a significant impact on the confidentiality of the information stored. However, the integrity and availability of the system remain unaffected.
CVE-2025-42960 is a security vulnerability (CVSS 4.3) that allows an authenticated attacker. Remediation should follow standard vulnerability management procedures.
CVE-2025-42953 is a security vulnerability (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A security vulnerability in SAP Business Warehouse and SAP Plug-In Basis (CVSS 7.7) that allows an authenticated attacker. High severity vulnerability requiring prompt remediation.
Unrestricted file upload in Advanced Online Voting System 1.0's /admin/candidates_add.php endpoint allows remote authenticated attackers (low privileges) to upload arbitrary files via the photo parameter. Public exploit code is available, but EPSS indicates low exploitation probability (0.10%) and no active exploitation is confirmed. The vulnerability could lead to code execution if a malicious PHP file is uploaded.
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially enabling remote code execution. A public proof-of-concept exploit is available, and the vulnerability is rated critical although the CVSS 4.0 base score suggests low impact. No active exploitation has been confirmed.
An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical attacker to bypass the lock screen and access user files by removing the stylus while the device is closed and using the screen capture feature.
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite [system source type](https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.2/configure-source-types/create-source-types) configurations by sending a specially-crafted payload to the `/servicesNS/nobody/search/admin/sourcetypes/` REST endpoint on the Splunk management port.
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn off the scheduled search `Bucket Copy Trigger` within the Splunk Archiver application. This is because of missing access controls in the saved searches for this app.
In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles, and has read-only access to a specific alert, could suppress that alert when it triggers. See [Define alert suppression groups to throttle sets of similar alerts](https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.4/manage-alert-trigger-conditions-and-throttling/define-alert-suppression-groups-to-throttle-sets-of-similar-alerts).
A security vulnerability in giscus (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. The firmware file, rootfs.tar.gz, contains hard-coded credentials for the Twilio API. A remote attacker who obtains a copy of the firmware can extract these credentials. This could allow the attacker to gain unauthorized access to the associated Twilio account, leading to information disclosure, potential service disruption, and unauthorized use of the Twilio services.
An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB Server v8.0 versions prior to 8.0.7, MongoDB Server v7.0 versions prior to 7.0.19 and MongoDB Server v6.0 versions prior to 6.0.22
Unrestricted file upload in Online Note Sharing 1.0 allows authenticated attackers to upload arbitrary files via the profile image handler, potentially leading to remote code execution. The vulnerability exists in the /
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.
CVE-2025-3466 is a security vulnerability (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.
A security vulnerability in A vulnerability (CVSS 8.5). High severity vulnerability requiring prompt remediation.
A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the function PUT of the file apps/rowboat/app/api/uploads/[fileId]/route.ts of the component Session Handler. The manipulation of the argument params leads to missing authentication. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is expected that this issue will be fixed in the near future.
Missing authentication in the file upload API endpoint of SimStudioAI Sim allows remote unauthenticated attackers to upload arbitrary files. The vulnerability affects all versions up to commit 37786d371e17d35e0764e1b5cd519d873d90d97b. Public exploit code is available, though no active exploitation in the wild has been confirmed (not listed in CISA KEV).
Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this vulnerability may allow the peer device to use the camera without user awareness.
CVE-2025-53168 is a security vulnerability (CVSS 5.7) that allows the peer device. Remediation should follow standard vulnerability management procedures.
Unrestricted file upload in BoyunCMS up to version 1.4.20 allows remote attackers to upload arbitrary files via the image parameter in /application/user/controller/Index.php. Exploit code is publicly available, but EPSS indicates low exploitation probability (0.08%) and no active exploitation in CISA KEV.
A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
JWT token forgery in Done-0 Jank (all rolling-release builds up to commit 322caebbad10568460364b9667aa62c3080bfc17) allows remote attackers to authenticate without valid credentials by using hardcoded signing secrets ('jank-blog-secret' and 'jank-blog-refresh-secret'). Exploit code is publicly available but active exploitation is not confirmed; EPSS (0.04%) and low CVSS indicate limited real-world risk.
Authentication bypass in bluebell-plus 2.x allows remote attackers to forge JWT tokens and gain unauthorized access by exploiting a hardcoded signing secret.
Unrestricted file upload in BlackVue DR590X dashcam firmware allows unauthenticated attackers on the local network to upload arbitrary files via the /upload.cgi HTTP endpoint, achieving full device compromise. A public proof-of-concept exploit is available, but the vendor has not responded or released a patch. The low EPSS score (0.06%) and absence from CISA KEV suggest limited real-world exploitation so far.
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.
NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions of the application, a password comparison is performed using the `==` operator at line 40 in front/index.php. This introduces a security issue where specially crafted "magic hash" values that evaluate to true in a loose comparison can bypass authentication. Because of the use of `==` instead of the strict `===`, different strings that begin with 0e and are followed by only digits can be interpreted as scientific notation (i.e., zero) and treated as equal. This issue falls under the Login Bypass vulnerability class. Users with certain "weird" passwords that produce magic hashes are particularly affected. Services relying on this logic are at risk of unauthorized access. Version 25.6.7 fixes the vulnerability.
A security vulnerability in newer MediaWiki (CVSS 7.5). High severity vulnerability requiring prompt remediation.
A security vulnerability in MbedTLS 3.3.0 (CVSS 4.9). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in pietro MobiLoud (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A security vulnerability in Missing Authorization vulnerability in vgwort VG WORT METIS (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Authenticated attackers with low privileges can exploit missing authorization checks in Paytiko for WooCommerce versions up to 1.3.14 to modify plugin data, leading to high integrity impact but no confidentiality or availability loss. The vulnerability, classified as CWE-862, has
Missing authorization in Gnuget MF Plus WPML plugin versions up to 1.1 allows unauthenticated attackers to modify settings. The vulnerability has a CVSS base score of 6.5, affecting integrity and availability without confidentiality impact, but no active exploitation is known and EPSS score (0.06%) indicates a low probability of real-world attacks.
Unauthorized settings modification in WC Pickup Store (WordPress plugin by Keylor Mendoza) versions up to 1.8.9 allows unauthenticated attackers to alter plugin configuration, potentially disrupting pickup store operations. No active exploitation (CISA KEV) or public exploit code has been identified, and EPSS probability is very low (0.06%).
A security vulnerability in Missing Authorization vulnerability in ashanjay EventON (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in amazewp fluXtore (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization check in LMSACE Connect plugin for WordPress up to version 3.4 allows authenticated low‑privilege users to bypass access controls and modify plugin data. No public exploit code or active exploitation is known, and EPSS stands at 0.04%, indicating very low immediate risk.
Missing authorization in ZoomIt WooCommerce Shop Page Builder allows authenticated attackers to bypass access controls and modify shop pages. The vulnerability affects versions up to 2.27.7 and has a low EPSS exploitation probability (0.04%), indicating no widespread exploitation is expected. No public exploit code has been identified at this time.
Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.
A security vulnerability in Booking X (CVSS 7.5). High severity vulnerability requiring prompt remediation.
A security vulnerability in plugin for WordPress is vulnerable to unauthorized post access in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators.
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $_POST['role'] and, after basic cleaning via hrm_clean(), passes it directly to wp_insert_user() and later to $user->set_role() without verifying that the current user is allowed to assign that role. This makes it possible for authenticated attackers, with Employee-level access and above, to elevate their privileges to administrator.
n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. This issue has been patched in version 1.99.1. A workaround involves restricting access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway.
Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to source code and control network, the attacker can bypass the REST interface authentication and gain access to MQTT configuration data. This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016.
Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Authorization.This issue affects Mediawiki - Scribunto Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
In Melapress File Monitor plugin for WordPress before 2.2.0, missing authorization checks allow authenticated attackers to exploit incorrectly configured access control, potentially leading to unauthorized modification of integrity or availability of monitored data. The vulnerability carries a CVSS 3.1 base score of 5.4 (medium) and has a low EPSS exploitation probability (0.06%), with no known active exploitation or public exploit code. A vendor patch in version 2.2.0 addresses the issue.
During startup, the device automatically logs in the EPC2 Windows user without requesting a password.
System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This leads to unintentional disclosure of sensitive information such as api keys, passwords, etc. A malicious actor with read access to these logs could obtain secrets and further use them to gain unauthorized access to other systems. Starting with version 4.43.0 Docker Desktop no longer logs system environment variables as part of diagnostics log collection.
CVE-2025-0885 is a security vulnerability (CVSS 1.8) that allows unauthorized access. Remediation should follow standard vulnerability management procedures.
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.
Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack.
Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication.
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.
CVE-2025-6942 is a security vulnerability (CVSS 3.8) that allows an attacker. Remediation should follow standard vulnerability management procedures.
A security vulnerability in HomeBox (CVSS 5.3) that allows authenticated users. Remediation should follow standard vulnerability management procedures.
Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System > Configuration > Users > "Allow users to create personal access tokens".
A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts within the upgrade.sh or disk image components. These modified upgrade images are not validated for authenticity or integrity, and are executed by the system post-upload, enabling root access.
A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service, responsible for integration with GFI AppManager, exposes HTTP services on ports 7995 and 7996 without proper authentication. The /proxy handler on port 7996 allows arbitrary forwarding to administrative endpoints when provided with an Appliance UUID, which itself can be retrieved from port 7995. This results in a complete authentication bypass, permitting access to sensitive administrative APIs.
An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to internal services such as GFIAgent, bypassing firewall restrictions and exposing internal management endpoints. This enables unauthenticated attackers to access the GFIAgent service on ports 7995 and 7996, retrieve the appliance UUID, and issue administrative requests via the proxy. Exploitation results in full administrative access to the Kerio Control appliance.
An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Unauthorized data modification and availability impact in Mollie Payments for WooCommerce plugin up to version 8.0.2 via missing authorization checks allows unauthenticated remote attackers to manipulate payment settings with no user interaction. Confidentiality is not impacted, and the low integrity and availability effects limit damage. No public exploit or active exploitation has been
A security vulnerability in Soumettre.fr (CVSS 3.7). Remediation should follow standard vulnerability management procedures.
The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates.
A remote code execution vulnerability (CVSS 9.8). Critical severity with potential for significant impact on affected systems.
Missing authorization in The Plus Addons for Elementor Pro allows authenticated attackers to manipulate access controls, leading to data modification and service disruption. Versions prior to 6.3.7 are affected. No known active exploitation or public exploit exists, and the EPSS probability is very low (0.06%).
A security vulnerability in is a ticket escalation process helper for GLPI. (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen and view the wallet balance.