CVE-2025-43926

An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other function calls, which then might use these keys/values to affect permissions or other settings.

• CWE-79

• https://www.znuny.org/en/advisories/zsa-2025-07Vendor Advisory
• https://znuny.comProduct

Published

May 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-43920GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certa…8.1
• CVE-2025-43921GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows u…5.3
• CVE-2025-43922The FileWave Windows client before 16.0.0, in some non-defau…8.1
• CVE-2025-43923An issue was discovered in ReportController in Unicom Focal …6.5
• CVE-2025-43924Cross Site Scripting vulnerability was discovered in Unicom …6.1
• CVE-2025-43925An issue was discovered in Unicom Focal Point 7.6.1. The dat…4.6
• CVE-2025-43928In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web s…9.8
• CVE-2025-43929open_actions.py in kitty before 0.41.0 does not ask for user…7.8
• CVE-2025-4393Medtronic MyCareLink Patient Monitor has an internal service…6.5
• CVE-2025-43930Hashview 0.8.1 allows account takeover via the password rese…9.8
• CVE-2025-43931flask-boilerplate through a170e7c allows account takeover vi…9.8
• CVE-2025-43932JobCenter through 7e7b0b2 allows account takeover via the pa…9.8