CVE-2025-59416

The Scratch Channel is a news website. If the user makes a fork, they can change the admins and make an article. Since the API uses a POST request, it will make an article. This issue is fixed in v1.2.

• CWE-862

• https://github.com/The-Scratch-Channel/tsc-web-client/security/advisories/GHSA-775w-g375-pjff

Published

Sep 17, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59410Dragonfly is an open source P2P-based file distribution and …3.7
• CVE-2025-59411CubeCart is an ecommerce software solution. Prior to version…5.4
• CVE-2025-59412CubeCart is an ecommerce software solution. Prior to version…5.4
• CVE-2025-59413CubeCart is an ecommerce software solution. Prior to version…6.5
• CVE-2025-59414Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2025-59415Frappe Learning is a learning system that helps users struct…5.4
• CVE-2025-59417Lobe Chat is an open-source artificial intelligence chat fra…6.1
• CVE-2025-59418BunnyPad is a note taking software. Prior to version 11.0.27…5.5
• CVE-2025-59419Netty is an asynchronous, event-driven network application f…5.5
• CVE-2025-5942Netskope was notified about a potential gap in its agent (NS…5.7
• CVE-2025-59420Authlib is a Python library which builds OAuth and OpenID Co…7.5
• CVE-2025-59421Press, a Frappe custom app that runs Frappe Cloud, manages i…2.7