CWE-266
CVEs classified under CWE-266, newest first.
407 CVEsRSS
CVE-2025-10038Medium· 6.5The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0
The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration…
CVE-2025-11554Medium· 6.3PoCA security vulnerability has been detected in Portabilis i-Educar up to 2.9.10
A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manip…
CVE-2025-11440Medium· 4.3A vulnerability was determined in JhumanJ OpnForm up to 1.9.3
A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publ…
CVE-2025-61785Low· 3.3Deno is a JavaScript, TypeScript, and WebAssembly runtime
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's p…
CVE-2025-11272Medium· 5.4A vulnerability has been found in SeriaWei ZKEACMS up to 4.3
A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to i…
CVE-2025-11050Medium· 6.3A flaw has been found in Portabilis i-Educar up to 2.10
A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /periodo-lancamento. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been p…
CVE-2025-11049Medium· 6.3A vulnerability was detected in Portabilis i-Educar up to 2.10
A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao-aluno. Performing manipulation results in improper authorization. Remote exploitation of the att…
CVE-2025-59945High· 8.1SysReptor is a fully customizable pentest reporting platform
SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to…
CVE-2025-11080Medium· 4.3A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4
A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. This vulnerability affects the function selectStudentExamInfoList of the file src/main/java/com/education/api/controller/student/ExamInfoControl…
CVE-2025-10992Medium· 5.3A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40
A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack …
CVE-2025-10989Medium· 6.3A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorizatio…
CVE-2025-10988Medium· 6.3A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09
A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The e…
CVE-2025-10987Medium· 6.3A vulnerability was determined in YunaiV yudao-cloud up to 2025.09
A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId…
CVE-2025-11048Medium· 6.3A security vulnerability has been detected in Portabilis i-Educar up to 2.10
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-dispensas. Such manipulation leads to improper authorization. The attack may b…
CVE-2025-11047Medium· 6.3A weakness has been identified in Portabilis i-Educar up to 2.10
A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argument aluno_id causes improper authorization. The attack may be initiated remote…
CVE-2025-11030High· 7.3A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60
A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of the file /admin/all-applied-leave.php of the component HTTP Request Handler. …
CVE-2025-10941High· 7.8A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1
A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functionality of the file SERVCoreTeller_2.0.40D.msi of the component Installer. Executing manipulation can lead to permiss…
CVE-2025-10822Medium· 4.3A vulnerability has been found in fuyang_lipengjun platform 1.0
A vulnerability has been found in fuyang_lipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Such manipulation leads to improper authorization. The attack may be performed fr…
CVE-2025-10821Medium· 4.3A flaw has been found in fuyang_lipengjun platform 1.0
A flaw has been found in fuyang_lipengjun platform 1.0. The affected element is the function TopicCategoryController of the file /topiccategory/queryAll. This manipulation causes improper authorization. The attack is possible to be carri…
CVE-2025-10820Medium· 4.3A vulnerability was detected in fuyang_lipengjun platform 1.0
A vulnerability was detected in fuyang_lipengjun platform 1.0. Impacted is the function TopicController of the file /topic/queryAll. The manipulation results in improper authorization. The attack can be executed remotely. The exploit is …
CVE-2025-10819Medium· 4.3A security vulnerability has been detected in fuyang_lipengjun platform 1.0
A security vulnerability has been detected in fuyang_lipengjun platform 1.0. This issue affects the function UserCouponController of the file /usercoupon/queryAll. The manipulation leads to improper authorization. Remote exploitation of …
CVE-2025-10644Critical· 9.40dayWondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability
Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on Wondershare Repairit. Authentication is not required to exploit th…
CVE-2025-10608Medium· 6.3A vulnerability was detected in Portabilis i-Educar up to 2.10
A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carri…
CVE-2025-10278Medium· 6.3PoCYunaiV ruoyi-vue-pro transfer improper authorization
A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. The attack is possible to…
CVE-2025-10276Medium· 6.3PoCYunaiV ruoyi-vue-pro transfer improper authorization
A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorizat…
CVE-2025-10275Medium· 6.3PoCYunaiV yudao-cloud transfer improper authorization
A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing a manipulation of the argument ids/newOwnerUserId can lead to improper authorization. The atta…
CVE-2025-10277Medium· 6.3PoCA vulnerability was detected in YunaiV yudao-cloud up to 2025.09
A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be exe…
CVE-2025-10209Medium· 5.4A security flaw has been discovered in Papermerge DMS up to 3.5.3
A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Performing manipulation results in improper authorization. The attack can be init…
CVE-2025-10073Medium· 4.3A vulnerability was determined in Portabilis i-Educar up to 2.10
A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The…
CVE-2025-10070Medium· 6.3PoCPortabilis i-Educar enturmacao-em-lote access control
A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has…