CVE-2025-25968

DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files (e.g., cm3.xml), attackers can bypass access controls, leading to account takeover and potential privilege escalation.

• CWE-284

• https://github.com/padayali-JD/CVE-2025-25968Third Party Advisory

Published

Feb 20, 2025

Last Modified

Jul 5, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25957Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 an…6.1
• CVE-2025-25958Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 all…5.4
• CVE-2025-2596Session logout could be overwritten in Checkmk GmbH's Checkm…5.3
• CVE-2025-25960Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allow…6.1
• CVE-2025-25962An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.…9.8
• CVE-2025-25967Acora CMS version 10.1.1 is vulnerable to Cross-Site Request…8.8
• CVE-2025-2597Reflected Cross-Site Scripting (XSS) in ITIUM 6050 version 5…6.1
• CVE-2025-25973A stored Cross Site Scripting vulnerability in the "related …6.5
• CVE-2025-25975An issue in parse-git-config v.3.0.0 allows an attacker to o…7.5
• CVE-2025-25977An issue in canvg v.4.0.2 allows an attacker to execute arbi…9.8
• CVE-2025-2598When the AWS Cloud Development Kit (AWS CDK) Command Line In…5.7
• CVE-2025-25983An issue in Macro-video Technologies Co.,Ltd V380 Pro androi…3.4