CVE-2025-25683

AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1.

• CWE-284

• https://aleksis.org/news/2025/01/security-advisory-cve-2025-25683-pdf-files-accessible-without-authentication/
• https://edugit.org/AlekSIS/official/AlekSIS-Core/-/issues/1180

Published

Mar 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25675Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnera…9.8
• CVE-2025-25676Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer…9.8
• CVE-2025-25678Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer…9.8
• CVE-2025-25679Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer…8
• CVE-2025-2568The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommer…5.3
• CVE-2025-25680LSC Smart Connect LSC Indoor PTZ Camera 7.6.32 is contains a…7.7
• CVE-2025-25684A lack of validation in the path parameter (/download) of GL…7.5
• CVE-2025-25685An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0…7.5
• CVE-2025-25686semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuctio…9.8
• CVE-2025-25691A PHAR deserialization vulnerability in the component /theme…6.5
• CVE-2025-25692A PHAR deserialization vulnerability in the _getHeaders func…6.5
• CVE-2025-2570Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail…2.7