CVE-2025-69727

An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components (index.js and composeUrlImgPhotoIndividu) allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to missing authorization checks and lack of rate-limiting when generating or accessing these URLs, an unauthenticated or unauthorized actor may retrieve profile pictures of users by crafting requests with guessed or known identifiers.

• CWE-284
• CWE-639

• https://demo.index-education.net/pronote
• https://github.com/0xZeroSec/CVE-2025-69727

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6970The Events Manager – Calendar, Bookings, Tickets, and more! …7.5
• CVE-2025-69700Tenda FH1203 V2.0.1.6 contains a stack-based buffer overflow…7.5
• CVE-2025-6971Use After Free vulnerability exists in the CATPRODUCT file r…7.8
• CVE-2025-6972Use After Free vulnerability exists in the CATPRODUCT file r…7.8
• CVE-2025-69720The infocmp command-line tool in ncurses before 6.5-20251213…7.8
• CVE-2025-69725An Open Redirect vulnerability in the go-chi/chi >=5.2.2 Red…4.7
• CVE-2025-6973Use After Free vulnerability exists in the JT file reading p…7.8
• CVE-2025-6974Use of Uninitialized Variable vulnerability exists in the JT…7.8
• CVE-2025-69749Cross Site Scripting vulnerability in tale v.2.0.5 allows an…6.1
• CVE-2025-6975The Events Manager – Calendar, Bookings, Tickets, and more! …6.1
• CVE-2025-69752An issue in the "My Details" user profile functionality of I…4.3
• CVE-2025-69755An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 a…8.2