Authentication Bypass
Monthly
Cryptographic weakness in Ivanti Workspace Control prior to version 10.19.0.0 that uses a hardcoded encryption key to protect SQL database credentials stored locally. A local authenticated attacker with user-level privileges can exploit this to decrypt and extract stored SQL credentials without elevated permissions, potentially leading to lateral movement and data exfiltration. The CVSS 8.8 score reflects high severity due to confidentiality and integrity impacts across system boundaries, though exploitation requires local access and valid authentication.
CVE-2024-34711 is an improper URI validation vulnerability in GeoServer that allows unauthenticated attackers to bypass XML External Entity (XXE) filtering and perform information disclosure attacks against internal networks. The vulnerability affects GeoServer versions prior to 2.25.0, where a weak regex pattern in the PreventLocalEntityResolver class fails to adequately block malicious URIs, enabling attackers to make arbitrary HTTP requests and scan internal infrastructure. With a CVSS score of 9.3 and high exploitation probability, this vulnerability poses a significant risk for network reconnaissance and potential lateral movement attacks.
CVE-2025-49509 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.
CVE-2025-1041 is a security vulnerability (CVSS 9.9) that allows an unauthorized remote command. Critical severity with potential for significant impact on affected systems.
Critical authentication bypass vulnerability in code-projects Laundry System 1.0 affecting the /data/ endpoint, allowing unauthenticated remote attackers to read, modify, and potentially disrupt system availability. The vulnerability has been publicly disclosed with exploit code available, and while CVSS 7.3 indicates moderate-to-high severity, the network-based attack vector (AV:N), lack of privilege requirement (PR:N), and absence of user interaction (UI:N) make this immediately exploitable in production environments. Active exploitation is likely given public POC availability and the ease of attack execution.
CVE-2025-42998 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability (CVSS 6.7) that allows the attacker. Remediation should follow standard vulnerability management procedures.
CVE-2025-42991 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
CVE-2025-42987 is a security vulnerability (CVSS 4.3) that allows an attacker with basic privileges. Remediation should follow standard vulnerability management procedures.
CVE-2025-42984 is a security vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Critical authentication bypass vulnerability in Lablup's BackendAI registration feature that allows unauthenticated attackers to create arbitrary user accounts and access private data, even when registration is administratively disabled. With a CVSS score of 9.8 and network-based attack vector requiring no privileges or user interaction, this vulnerability poses an immediate and severe risk to all BackendAI deployments. The vulnerability enables account creation without proper authentication controls (CWE-306), potentially allowing attackers to gain unauthorized access to sensitive computational resources and data.
An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Biometric Authentication Module
Missing Authorization (CWE-862) vulnerability in WP Swings Membership For WooCommerce that allows unauthenticated attackers to access functionality not properly constrained by Access Control Lists (ACLs). The vulnerability affects versions up to and including 2.8.1 of this WordPress/WooCommerce plugin, enabling unauthorized users to bypass membership restrictions and potentially access premium features or sensitive membership data without valid credentials. With a CVSS score of 7.5 and a network-accessible attack vector requiring no privileges or user interaction, this represents a significant exposure risk for e-commerce sites relying on this plugin for membership management.
Missing authorization in CryptoCloud - Crypto Payment Gateway for WordPress allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying payment gateway settings or disrupting transactions. The vulnerability affects versions through 2.1.2, with no public exploit identified at time of analysis.
A security vulnerability in Missing Authorization vulnerability in relentlo StyleAI (CVSS 6.5) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing Authorization vulnerability (CWE-862) in the Icegram Collect WordPress plugin versions up to 1.3.18 that allows authenticated attackers with low privileges to exploit misconfigured access controls. An attacker with a valid WordPress user account can modify or delete form data and potentially cause service disruption by leveraging inadequate authorization checks on sensitive operations, with no confidentiality impact but significant integrity and availability risks.
Missing Authorization vulnerability in Fahad Mahmood's Stock Locations for WooCommerce plugin (versions up to 2.8.6) that allows authenticated users with low privileges to perform unauthorized actions including information disclosure and availability disruption. An attacker with basic user credentials can bypass access controls to modify stock locations or trigger denial-of-service conditions due to improper privilege verification. This vulnerability has a CVSS score of 7.1 (High) and affects WooCommerce installations using the vulnerable plugin; KEV status and active exploitation data are not currently confirmed in public advisories.
Missing Authorization vulnerability (CWE-862) in looks_awesome Team Builder versions up to 1.5.7 that allows authenticated attackers to exploit misconfigured access control security levels to gain unauthorized access to sensitive functionality. An attacker with valid credentials can bypass intended authorization checks to read, modify, or delete data they should not have access to. The CVSS 7.6 score reflects the combination of low attack complexity, authenticated access requirement, and moderate-to-high impact on confidentiality and integrity.
CVE-2025-31022 is an authentication bypass vulnerability in PayU India's payment processing platform (versions before 3.8.8) that allows attackers to bypass authentication mechanisms via an alternate path or channel, granting unauthorized access to sensitive payment and customer data. With a critical CVSS score of 9.8 and network-based attack vector requiring no privileges or user interaction, this vulnerability poses an immediate and severe threat to all PayU India users and their customers' payment information. Active exploitation status and public disclosure details should be verified through CISA KEV database and PayU's official security advisories.
CVE-2025-31019 is an authentication bypass vulnerability in miniOrange Password Policy Manager that allows authenticated attackers to escalate privileges and abuse authentication mechanisms through alternate pathways. Affected versions are 2.0.4 and earlier; attackers with low privileges (PR:L) can exploit this remotely without user interaction (UI:N) to achieve complete system compromise including confidentiality, integrity, and availability impacts. No public KEV or active exploitation data is available at this time, but the high CVSS score of 8.8 and authentication bypass nature indicate significant risk to WordPress sites using this plugin.
CVE-2025-40670 is an incorrect authorization vulnerability in TCMAN's GIM (Gestion Integrada de Mantenimiento) v11 that allows an authenticated but unprivileged attacker to escalate privileges by creating new users with elevated permissions through an insecure API endpoint. An attacker with valid (low-privilege) credentials can POST to /PC/frmGestionUser.aspx/updateUser to arbitrarily assign administrative or other high-privilege roles to newly created accounts, resulting in complete system compromise. This vulnerability represents a critical privilege escalation risk in maintenance management systems, potentially affecting industrial and critical infrastructure environments that rely on TCMAN for asset management.
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&Page=-1.
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty.
A vulnerability classified as problematic was found in Lucky LM-520-SC, LM-520-FSC and LM-520-FSC-SAM up to 20250321. Affected by this vulnerability is an unknown functionality. The manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior contain an authenticated SQL injection vulnerability in the alerts module (CWE-89) that allows authenticated users to execute arbitrary SQL commands. An attacker with valid credentials can exploit this network-accessible vulnerability to read sensitive data, modify database contents, or degrade system availability. The CVSS 8.3 score reflects high confidentiality and integrity impact, though authentication is required; real-world exploitation probability and active weaponization status cannot be confirmed without KEV/EPSS data access.
A security vulnerability in eCharge Hardy Barth Salia PLCC (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
A vulnerability was found in eGauge EG3000 Energy Monitor 3.6.3. It has been classified as problematic. This affects an unknown part of the component Setting Handler. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in Papendorf SOL Connect Center 3.3.0.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Web Interface. The manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Critical authentication bypass vulnerability in TRENDnet TV-IP121W IP camera (version 1.1.1 Build 36) affecting the /admin/setup.cgi web interface endpoint. An unauthenticated remote attacker can bypass authentication controls to gain unauthorized administrative access, potentially allowing unauthorized configuration changes, data theft, or device compromise. A public exploit has been disclosed, the vendor has not responded to early disclosure, and the vulnerability exhibits moderate real-world exploitation probability given its network-accessible nature and lack of authentication requirements.
Quantenna Wi-Fi chipsets ship with an unauthenticated telnet interface enabled by default, allowing remote attackers to gain full administrative access without credentials. This affects Quantenna Wi-Fi chipset SDK through version 8.0.0.28, and while no official patch has been released at the time of CVE publication, the vendor has provided a best practices guide for implementors. The vulnerability enables both complete confidentiality and integrity compromise of affected devices.
moPS App through version 1.8.618 contains a critical authentication bypass vulnerability (CVE-2024-55585, CVSS 9.0) that allows all authenticated users to access administrative API endpoints without proper authorization checks, enabling unrestricted read and write operations including password resets. This vulnerability is particularly severe as it requires only low privileges (PR:L) to exploit via network access, and the /api/v1/users/resetpassword endpoint demonstrates direct administrative function access. No KEV or active exploitation data is referenced, but the high CVSS score and authentication bypass nature suggest significant real-world risk if exploited.
A security vulnerability in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization vulnerability in Christiaan Pieterse MaxiBlocks WordPress plugin (versions up to 2.1.0) that allows authenticated users with low privileges to escalate their access and perform unauthorized actions with high impact. An attacker with basic user credentials can bypass authorization checks to modify content, user accounts, or plugin settings, potentially leading to complete site compromise. The high CVSS score of 8.8 reflects the severe impact, though exploitation requires prior authentication access.
Critical authentication bypass vulnerability in the 70mai A510 dashcam that exploits default credentials in the device's user account configuration. Network-adjacent attackers can bypass authentication without any credentials and achieve remote code execution with root privileges. This vulnerability presents an immediate and severe risk due to its low attack complexity, lack of user interaction requirement, and the widespread deployment of 70mai dashcams in vehicles.
CVE-2025-49599 is a security vulnerability (CVSS 4.1) that allows the epuser account. Remediation should follow standard vulnerability management procedures.
WOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of management cards. The issue results from the lack of personalization of management cards. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26292.
Critical authentication bypass vulnerability in WOLFBOX Level 2 EV Charger devices caused by uninitialized cryptographic key variables in BLE vendor-specific encrypted communications. Network-adjacent attackers can completely bypass authentication without credentials, gaining full system access (confidentiality, integrity, and availability compromise). The vulnerability (CVSS 8.8) affects encrypted BLE communications and represents a significant risk to EV charging infrastructure security, though real-world exploitation likelihood depends on proximity requirements and patch availability from WOLFBOX.
Critical remote code execution vulnerability in WOLFBOX Level 2 EV Charger devices that exploits an exposed dangerous method in the Tuya communications module, allowing network-adjacent attackers to upload and execute arbitrary code despite authentication requirements. The authentication bypass mechanism combined with the exposed software upload functionality creates a high-severity attack path that can grant attackers complete control over affected EV charger installations. This vulnerability (formerly ZDI-CAN-26349) presents significant risk to vehicle charging infrastructure and connected IoT deployments relying on Tuya-based communication protocols.
CVE-2025-30279 is an improper certificate validation vulnerability in QNAP File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. Affected versions are below 5.5.6.4847; the vulnerability requires valid user credentials but no user interaction, making it a significant post-authentication attack vector with a CVSS score of 8.8 indicating high severity.
CVE-2025-29885 is an improper certificate validation vulnerability in Synology File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. The vulnerability affects File Station 5 versions prior to 5.5.6.4791 and requires valid user credentials to exploit. With a CVSS score of 8.8 and a low attack complexity, this represents a significant risk to organizations running vulnerable versions, though exploitation requires prior authentication.
CVE-2025-29884 is an improper certificate validation vulnerability affecting Synology File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. The vulnerability requires user-level access but enables complete system compromise with high impact across all security dimensions. No active KEV or public POC data is currently available, but the CVSS 8.8 score and low attack complexity indicate this should be prioritized for patching.
CVE-2025-29883 is an improper certificate validation vulnerability affecting Synology File Station 5 that allows authenticated remote attackers to compromise system security through man-in-the-middle attacks or credential harvesting. The vulnerability requires valid user credentials (PR:L) but can result in complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 8.8). Patched versions are available for File Station 5 5.5.6.4791 and later.
CVE-2024-13088 is an improper authentication vulnerability (CWE-287) affecting QHora/QuRouter that allows local network attackers with low privileges to compromise system confidentiality, integrity, and availability. The vulnerability requires local network access and low privileges but no user interaction, making it a significant risk for networked environments. Patch versions QuRouter 2.5.0.140 and later are available, though KEV/EPSS data and active exploitation status are not confirmed in the provided intelligence.
Critical remote authentication bypass vulnerability affecting an unspecified software package, exploitable through improper type conversion handling (CWE-704). An unauthenticated network attacker can bypass authentication controls without user interaction to achieve complete device compromise including confidentiality, integrity, and availability violations. The vulnerability carries a maximum CVSS 3.1 score of 9.8 with network accessibility and low attack complexity, indicating high real-world exploitability risk; without access to KEV/EPSS data or POC confirmation, exploitation likelihood cannot be definitively assessed but the attack vector and complexity profile suggests active exploitation potential.
Missing authorization in the WordPress plugin Interactive Regional Map of Florida up to version 1.0 allows unauthenticated attackers to modify plugin settings or data due to broken access controls. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been identified.
Missing authorization in Job Board Manager WordPress plugin up to version 2.1.60 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying data without authentication. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A remote code execution vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in Crawlomatic Multisite Scraper Post Generator allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying data. The vulnerability affects versions up to 2.6.8.2. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in add-ons (CVSS 5.0). Remediation should follow standard vulnerability management procedures.
Authenticated low-privileged users can exploit a missing authorization check in Ultimate WP Mail plugin for WordPress up to version 1.3.5 to bypass access controls, potentially leading to full site takeover.
Missing authorization in Product Feed for WooCommerce up to version 2.2.8 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying product feed settings. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in sergiotrinity Trinity Audio (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WP-CRM System up to version 3.4.2 allows unauthenticated attackers to access functionality not properly constrained by ACLs, potentially leading to unauthorized data access or modification. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in Verge3D WordPress plugin up to version 4.9.4 allows unauthenticated attackers to exploit incorrectly configured access controls, leading to low confidentiality impact. No public exploit or active exploitation identified; EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in cmoreira Team Showcase (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in cmoreira Testimonials Showcase (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in bobbingwide oik (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in nK DocsPress (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in raychat Raychat allows Accessing Functionality Not Properly Constrained by ACLs (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in Payment QR WooCommerce plugin for WordPress allows unauthenticated attackers to modify payment QR settings without proper access control. Affects versions up to 1.1.6. No public exploit or active exploitation identified, and EPSS score is low (0.06%).
Missing authorization in ThemeHunk plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized modification of settings or data. The vulnerability affects versions up to 1.1.1, with no public exploit or active exploitation reported.
Authenticated low-privilege users can bypass access controls in Slack Notifications by dorzki 2.0.7 and earlier, potentially disrupting notification delivery. Exploitation requires an authenticated session with low privileges and has no direct confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in Post Grid Master 3.4.13 and earlier allows authenticated attackers with low privileges to modify unauthorized settings. The vulnerability is due to missing authorization checks, enabling exploitation of incorrectly configured access control security levels. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Broken access control in Activity Plus Reloaded for BuddyPress up to version 1.1.2 allows authenticated attackers with low privileges to modify activity data or perform unauthorized actions. The vulnerability is due to missing authorization checks (CWE-862) and has a low EPSS score (0.07%), with no public exploit or active exploitation reported.
A security vulnerability in Missing Authorization vulnerability in taskbuilder Taskbuilder (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in the OS Diagnosis Generator WordPress plugin up to version 1.4.16 allows unauthenticated remote attackers to access and modify plugin functionality that is not properly constrained by access controls, leading to low-impact integrity compromise.
Missing authorization vulnerability in WP Compress for MainWP allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of settings or data. The issue affects versions through 6.30.32 and has a low EPSS score of 0.07%, with no public exploit or active exploitation confirmed.
Missing authorization in the Wordapp plugin for WordPress (up to version 1.7.0) allows authenticated users to access restricted data, resulting in low-impact information disclosure. No active exploitation or public exploit code has been reported.
Missing authorization in the WordPress Accessibility Suite plugin up to version 4.19 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or data. The vulnerability has a CVSS score of 5.4 (medium) and a low EPSS probability of 0.07%, with no evidence of active exploitation or public exploit code.
Missing authorization in WordLift plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying data. The vulnerability affects versions up to 3.54.4 and has a low EPSS score (0.06%), with no public exploit or active exploitation confirmed.
CVE-2025-29013 is a security vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in eleopard Behance Portfolio Manager (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in WP AutoKeyword 1.0 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying settings or data without proper permissions. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in GPP Slideshow WordPress plugin up to version 1.3.5 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of slideshow settings. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in viralloops Viral Loops WP Integration (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in viralloops Viral Loops WP Integration (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization check in Elastic Email Subscribe Form for WordPress up to version 1.2.2 allows authenticated low-privilege users to modify plugin settings or data, leading to limited integrity and availability impacts. No confidentiality loss, and EPSS indicates very low exploitation likelihood. No active exploitation reported.
Missing authorization vulnerability in No Spam At All WordPress plugin up to version 1.3 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of plugin settings or data. No public exploit or active exploitation has been identified, and EPSS score is low (0.07%).
A security vulnerability in Missing Authorization vulnerability in codelobster Responsive Flipbooks (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Missing authorization in bbPress API plugin for WordPress allows unauthenticated attackers to access sensitive data. The plugin versions up to 1.0.14 fail to properly enforce access controls on API endpoints, leading to potential information disclosure. No public exploit or active exploitation has been identified at this time.
A remote code execution vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in whassan KI Live Video Conferences (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in 6Storage 6Storage Rentals (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing Authorization vulnerability in SolaPlugins Sola Support Ticket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sola Support Ticket: from n/a through 3.17.
Missing authorization in QuickCab WordPress plugin up to version 1.3.3 allows unauthenticated attackers to modify settings or access restricted functionality. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been reported.
Missing authorization in Responsive Plus WordPress plugin up to version 3.2.0 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or content. No public exploit or active exploitation has been identified, and the EPSS score is low (0.07%).
Cryptographic weakness in Ivanti Workspace Control prior to version 10.19.0.0 that uses a hardcoded encryption key to protect SQL database credentials stored locally. A local authenticated attacker with user-level privileges can exploit this to decrypt and extract stored SQL credentials without elevated permissions, potentially leading to lateral movement and data exfiltration. The CVSS 8.8 score reflects high severity due to confidentiality and integrity impacts across system boundaries, though exploitation requires local access and valid authentication.
CVE-2024-34711 is an improper URI validation vulnerability in GeoServer that allows unauthenticated attackers to bypass XML External Entity (XXE) filtering and perform information disclosure attacks against internal networks. The vulnerability affects GeoServer versions prior to 2.25.0, where a weak regex pattern in the PreventLocalEntityResolver class fails to adequately block malicious URIs, enabling attackers to make arbitrary HTTP requests and scan internal infrastructure. With a CVSS score of 9.3 and high exploitation probability, this vulnerability poses a significant risk for network reconnaissance and potential lateral movement attacks.
CVE-2025-49509 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.
CVE-2025-1041 is a security vulnerability (CVSS 9.9) that allows an unauthorized remote command. Critical severity with potential for significant impact on affected systems.
Critical authentication bypass vulnerability in code-projects Laundry System 1.0 affecting the /data/ endpoint, allowing unauthenticated remote attackers to read, modify, and potentially disrupt system availability. The vulnerability has been publicly disclosed with exploit code available, and while CVSS 7.3 indicates moderate-to-high severity, the network-based attack vector (AV:N), lack of privilege requirement (PR:N), and absence of user interaction (UI:N) make this immediately exploitable in production environments. Active exploitation is likely given public POC availability and the ease of attack execution.
CVE-2025-42998 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability (CVSS 6.7) that allows the attacker. Remediation should follow standard vulnerability management procedures.
CVE-2025-42991 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
CVE-2025-42987 is a security vulnerability (CVSS 4.3) that allows an attacker with basic privileges. Remediation should follow standard vulnerability management procedures.
CVE-2025-42984 is a security vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Critical authentication bypass vulnerability in Lablup's BackendAI registration feature that allows unauthenticated attackers to create arbitrary user accounts and access private data, even when registration is administratively disabled. With a CVSS score of 9.8 and network-based attack vector requiring no privileges or user interaction, this vulnerability poses an immediate and severe risk to all BackendAI deployments. The vulnerability enables account creation without proper authentication controls (CWE-306), potentially allowing attackers to gain unauthorized access to sensitive computational resources and data.
An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Biometric Authentication Module
Missing Authorization (CWE-862) vulnerability in WP Swings Membership For WooCommerce that allows unauthenticated attackers to access functionality not properly constrained by Access Control Lists (ACLs). The vulnerability affects versions up to and including 2.8.1 of this WordPress/WooCommerce plugin, enabling unauthorized users to bypass membership restrictions and potentially access premium features or sensitive membership data without valid credentials. With a CVSS score of 7.5 and a network-accessible attack vector requiring no privileges or user interaction, this represents a significant exposure risk for e-commerce sites relying on this plugin for membership management.
Missing authorization in CryptoCloud - Crypto Payment Gateway for WordPress allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying payment gateway settings or disrupting transactions. The vulnerability affects versions through 2.1.2, with no public exploit identified at time of analysis.
A security vulnerability in Missing Authorization vulnerability in relentlo StyleAI (CVSS 6.5) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing Authorization vulnerability (CWE-862) in the Icegram Collect WordPress plugin versions up to 1.3.18 that allows authenticated attackers with low privileges to exploit misconfigured access controls. An attacker with a valid WordPress user account can modify or delete form data and potentially cause service disruption by leveraging inadequate authorization checks on sensitive operations, with no confidentiality impact but significant integrity and availability risks.
Missing Authorization vulnerability in Fahad Mahmood's Stock Locations for WooCommerce plugin (versions up to 2.8.6) that allows authenticated users with low privileges to perform unauthorized actions including information disclosure and availability disruption. An attacker with basic user credentials can bypass access controls to modify stock locations or trigger denial-of-service conditions due to improper privilege verification. This vulnerability has a CVSS score of 7.1 (High) and affects WooCommerce installations using the vulnerable plugin; KEV status and active exploitation data are not currently confirmed in public advisories.
Missing Authorization vulnerability (CWE-862) in looks_awesome Team Builder versions up to 1.5.7 that allows authenticated attackers to exploit misconfigured access control security levels to gain unauthorized access to sensitive functionality. An attacker with valid credentials can bypass intended authorization checks to read, modify, or delete data they should not have access to. The CVSS 7.6 score reflects the combination of low attack complexity, authenticated access requirement, and moderate-to-high impact on confidentiality and integrity.
CVE-2025-31022 is an authentication bypass vulnerability in PayU India's payment processing platform (versions before 3.8.8) that allows attackers to bypass authentication mechanisms via an alternate path or channel, granting unauthorized access to sensitive payment and customer data. With a critical CVSS score of 9.8 and network-based attack vector requiring no privileges or user interaction, this vulnerability poses an immediate and severe threat to all PayU India users and their customers' payment information. Active exploitation status and public disclosure details should be verified through CISA KEV database and PayU's official security advisories.
CVE-2025-31019 is an authentication bypass vulnerability in miniOrange Password Policy Manager that allows authenticated attackers to escalate privileges and abuse authentication mechanisms through alternate pathways. Affected versions are 2.0.4 and earlier; attackers with low privileges (PR:L) can exploit this remotely without user interaction (UI:N) to achieve complete system compromise including confidentiality, integrity, and availability impacts. No public KEV or active exploitation data is available at this time, but the high CVSS score of 8.8 and authentication bypass nature indicate significant risk to WordPress sites using this plugin.
CVE-2025-40670 is an incorrect authorization vulnerability in TCMAN's GIM (Gestion Integrada de Mantenimiento) v11 that allows an authenticated but unprivileged attacker to escalate privileges by creating new users with elevated permissions through an insecure API endpoint. An attacker with valid (low-privilege) credentials can POST to /PC/frmGestionUser.aspx/updateUser to arbitrarily assign administrative or other high-privilege roles to newly created accounts, resulting in complete system compromise. This vulnerability represents a critical privilege escalation risk in maintenance management systems, potentially affecting industrial and critical infrastructure environments that rely on TCMAN for asset management.
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&Page=-1.
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty.
A vulnerability classified as problematic was found in Lucky LM-520-SC, LM-520-FSC and LM-520-FSC-SAM up to 20250321. Affected by this vulnerability is an unknown functionality. The manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior contain an authenticated SQL injection vulnerability in the alerts module (CWE-89) that allows authenticated users to execute arbitrary SQL commands. An attacker with valid credentials can exploit this network-accessible vulnerability to read sensitive data, modify database contents, or degrade system availability. The CVSS 8.3 score reflects high confidentiality and integrity impact, though authentication is required; real-world exploitation probability and active weaponization status cannot be confirmed without KEV/EPSS data access.
A security vulnerability in eCharge Hardy Barth Salia PLCC (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
A vulnerability was found in eGauge EG3000 Energy Monitor 3.6.3. It has been classified as problematic. This affects an unknown part of the component Setting Handler. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in Papendorf SOL Connect Center 3.3.0.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Web Interface. The manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Critical authentication bypass vulnerability in TRENDnet TV-IP121W IP camera (version 1.1.1 Build 36) affecting the /admin/setup.cgi web interface endpoint. An unauthenticated remote attacker can bypass authentication controls to gain unauthorized administrative access, potentially allowing unauthorized configuration changes, data theft, or device compromise. A public exploit has been disclosed, the vendor has not responded to early disclosure, and the vulnerability exhibits moderate real-world exploitation probability given its network-accessible nature and lack of authentication requirements.
Quantenna Wi-Fi chipsets ship with an unauthenticated telnet interface enabled by default, allowing remote attackers to gain full administrative access without credentials. This affects Quantenna Wi-Fi chipset SDK through version 8.0.0.28, and while no official patch has been released at the time of CVE publication, the vendor has provided a best practices guide for implementors. The vulnerability enables both complete confidentiality and integrity compromise of affected devices.
moPS App through version 1.8.618 contains a critical authentication bypass vulnerability (CVE-2024-55585, CVSS 9.0) that allows all authenticated users to access administrative API endpoints without proper authorization checks, enabling unrestricted read and write operations including password resets. This vulnerability is particularly severe as it requires only low privileges (PR:L) to exploit via network access, and the /api/v1/users/resetpassword endpoint demonstrates direct administrative function access. No KEV or active exploitation data is referenced, but the high CVSS score and authentication bypass nature suggest significant real-world risk if exploited.
A security vulnerability in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization vulnerability in Christiaan Pieterse MaxiBlocks WordPress plugin (versions up to 2.1.0) that allows authenticated users with low privileges to escalate their access and perform unauthorized actions with high impact. An attacker with basic user credentials can bypass authorization checks to modify content, user accounts, or plugin settings, potentially leading to complete site compromise. The high CVSS score of 8.8 reflects the severe impact, though exploitation requires prior authentication access.
Critical authentication bypass vulnerability in the 70mai A510 dashcam that exploits default credentials in the device's user account configuration. Network-adjacent attackers can bypass authentication without any credentials and achieve remote code execution with root privileges. This vulnerability presents an immediate and severe risk due to its low attack complexity, lack of user interaction requirement, and the widespread deployment of 70mai dashcams in vehicles.
CVE-2025-49599 is a security vulnerability (CVSS 4.1) that allows the epuser account. Remediation should follow standard vulnerability management procedures.
WOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of management cards. The issue results from the lack of personalization of management cards. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26292.
Critical authentication bypass vulnerability in WOLFBOX Level 2 EV Charger devices caused by uninitialized cryptographic key variables in BLE vendor-specific encrypted communications. Network-adjacent attackers can completely bypass authentication without credentials, gaining full system access (confidentiality, integrity, and availability compromise). The vulnerability (CVSS 8.8) affects encrypted BLE communications and represents a significant risk to EV charging infrastructure security, though real-world exploitation likelihood depends on proximity requirements and patch availability from WOLFBOX.
Critical remote code execution vulnerability in WOLFBOX Level 2 EV Charger devices that exploits an exposed dangerous method in the Tuya communications module, allowing network-adjacent attackers to upload and execute arbitrary code despite authentication requirements. The authentication bypass mechanism combined with the exposed software upload functionality creates a high-severity attack path that can grant attackers complete control over affected EV charger installations. This vulnerability (formerly ZDI-CAN-26349) presents significant risk to vehicle charging infrastructure and connected IoT deployments relying on Tuya-based communication protocols.
CVE-2025-30279 is an improper certificate validation vulnerability in QNAP File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. Affected versions are below 5.5.6.4847; the vulnerability requires valid user credentials but no user interaction, making it a significant post-authentication attack vector with a CVSS score of 8.8 indicating high severity.
CVE-2025-29885 is an improper certificate validation vulnerability in Synology File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. The vulnerability affects File Station 5 versions prior to 5.5.6.4791 and requires valid user credentials to exploit. With a CVSS score of 8.8 and a low attack complexity, this represents a significant risk to organizations running vulnerable versions, though exploitation requires prior authentication.
CVE-2025-29884 is an improper certificate validation vulnerability affecting Synology File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. The vulnerability requires user-level access but enables complete system compromise with high impact across all security dimensions. No active KEV or public POC data is currently available, but the CVSS 8.8 score and low attack complexity indicate this should be prioritized for patching.
CVE-2025-29883 is an improper certificate validation vulnerability affecting Synology File Station 5 that allows authenticated remote attackers to compromise system security through man-in-the-middle attacks or credential harvesting. The vulnerability requires valid user credentials (PR:L) but can result in complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 8.8). Patched versions are available for File Station 5 5.5.6.4791 and later.
CVE-2024-13088 is an improper authentication vulnerability (CWE-287) affecting QHora/QuRouter that allows local network attackers with low privileges to compromise system confidentiality, integrity, and availability. The vulnerability requires local network access and low privileges but no user interaction, making it a significant risk for networked environments. Patch versions QuRouter 2.5.0.140 and later are available, though KEV/EPSS data and active exploitation status are not confirmed in the provided intelligence.
Critical remote authentication bypass vulnerability affecting an unspecified software package, exploitable through improper type conversion handling (CWE-704). An unauthenticated network attacker can bypass authentication controls without user interaction to achieve complete device compromise including confidentiality, integrity, and availability violations. The vulnerability carries a maximum CVSS 3.1 score of 9.8 with network accessibility and low attack complexity, indicating high real-world exploitability risk; without access to KEV/EPSS data or POC confirmation, exploitation likelihood cannot be definitively assessed but the attack vector and complexity profile suggests active exploitation potential.
Missing authorization in the WordPress plugin Interactive Regional Map of Florida up to version 1.0 allows unauthenticated attackers to modify plugin settings or data due to broken access controls. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been identified.
Missing authorization in Job Board Manager WordPress plugin up to version 2.1.60 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying data without authentication. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A remote code execution vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in Crawlomatic Multisite Scraper Post Generator allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying data. The vulnerability affects versions up to 2.6.8.2. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in add-ons (CVSS 5.0). Remediation should follow standard vulnerability management procedures.
Authenticated low-privileged users can exploit a missing authorization check in Ultimate WP Mail plugin for WordPress up to version 1.3.5 to bypass access controls, potentially leading to full site takeover.
Missing authorization in Product Feed for WooCommerce up to version 2.2.8 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying product feed settings. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in sergiotrinity Trinity Audio (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WP-CRM System up to version 3.4.2 allows unauthenticated attackers to access functionality not properly constrained by ACLs, potentially leading to unauthorized data access or modification. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in Verge3D WordPress plugin up to version 4.9.4 allows unauthenticated attackers to exploit incorrectly configured access controls, leading to low confidentiality impact. No public exploit or active exploitation identified; EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in cmoreira Team Showcase (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in cmoreira Testimonials Showcase (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in bobbingwide oik (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in nK DocsPress (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in raychat Raychat allows Accessing Functionality Not Properly Constrained by ACLs (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in Payment QR WooCommerce plugin for WordPress allows unauthenticated attackers to modify payment QR settings without proper access control. Affects versions up to 1.1.6. No public exploit or active exploitation identified, and EPSS score is low (0.06%).
Missing authorization in ThemeHunk plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized modification of settings or data. The vulnerability affects versions up to 1.1.1, with no public exploit or active exploitation reported.
Authenticated low-privilege users can bypass access controls in Slack Notifications by dorzki 2.0.7 and earlier, potentially disrupting notification delivery. Exploitation requires an authenticated session with low privileges and has no direct confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in Post Grid Master 3.4.13 and earlier allows authenticated attackers with low privileges to modify unauthorized settings. The vulnerability is due to missing authorization checks, enabling exploitation of incorrectly configured access control security levels. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Broken access control in Activity Plus Reloaded for BuddyPress up to version 1.1.2 allows authenticated attackers with low privileges to modify activity data or perform unauthorized actions. The vulnerability is due to missing authorization checks (CWE-862) and has a low EPSS score (0.07%), with no public exploit or active exploitation reported.
A security vulnerability in Missing Authorization vulnerability in taskbuilder Taskbuilder (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in the OS Diagnosis Generator WordPress plugin up to version 1.4.16 allows unauthenticated remote attackers to access and modify plugin functionality that is not properly constrained by access controls, leading to low-impact integrity compromise.
Missing authorization vulnerability in WP Compress for MainWP allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of settings or data. The issue affects versions through 6.30.32 and has a low EPSS score of 0.07%, with no public exploit or active exploitation confirmed.
Missing authorization in the Wordapp plugin for WordPress (up to version 1.7.0) allows authenticated users to access restricted data, resulting in low-impact information disclosure. No active exploitation or public exploit code has been reported.
Missing authorization in the WordPress Accessibility Suite plugin up to version 4.19 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or data. The vulnerability has a CVSS score of 5.4 (medium) and a low EPSS probability of 0.07%, with no evidence of active exploitation or public exploit code.
Missing authorization in WordLift plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying data. The vulnerability affects versions up to 3.54.4 and has a low EPSS score (0.06%), with no public exploit or active exploitation confirmed.
CVE-2025-29013 is a security vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in eleopard Behance Portfolio Manager (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in WP AutoKeyword 1.0 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying settings or data without proper permissions. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in GPP Slideshow WordPress plugin up to version 1.3.5 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of slideshow settings. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in viralloops Viral Loops WP Integration (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in viralloops Viral Loops WP Integration (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization check in Elastic Email Subscribe Form for WordPress up to version 1.2.2 allows authenticated low-privilege users to modify plugin settings or data, leading to limited integrity and availability impacts. No confidentiality loss, and EPSS indicates very low exploitation likelihood. No active exploitation reported.
Missing authorization vulnerability in No Spam At All WordPress plugin up to version 1.3 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of plugin settings or data. No public exploit or active exploitation has been identified, and EPSS score is low (0.07%).
A security vulnerability in Missing Authorization vulnerability in codelobster Responsive Flipbooks (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Missing authorization in bbPress API plugin for WordPress allows unauthenticated attackers to access sensitive data. The plugin versions up to 1.0.14 fail to properly enforce access controls on API endpoints, leading to potential information disclosure. No public exploit or active exploitation has been identified at this time.
A remote code execution vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in whassan KI Live Video Conferences (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in 6Storage 6Storage Rentals (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing Authorization vulnerability in SolaPlugins Sola Support Ticket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sola Support Ticket: from n/a through 3.17.
Missing authorization in QuickCab WordPress plugin up to version 1.3.3 allows unauthenticated attackers to modify settings or access restricted functionality. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been reported.
Missing authorization in Responsive Plus WordPress plugin up to version 3.2.0 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or content. No public exploit or active exploitation has been identified, and the EPSS score is low (0.07%).