CVE-2025-7699

An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server file system into their own EZSync folder. The vulnerability is due to a lack of authorization checks on the file parameter of the HTTP request. Attackers can exploit this flaw to access files outside their authorized scope, provided the file has readable permissions for other users on the underlying OS. This can lead to unauthorized exposure of sensitive data. Affected products and versions include: from ADM 4.1.0 to ADM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier.

• CWE-287

• https://www.asustor.com/security/security_advisory_detail?id=46

Published

Jul 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7693A security issue exists due to improper handling of malforme…9.3
• CVE-2025-7694The Woffice Core plugin for WordPress is vulnerable to arbit…7.5
• CVE-2025-7695The Dataverse Integration plugin for WordPress is vulnerable…8.8
• CVE-2025-7696The Integration for Pipedrive and Contact Form 7, WPForms, E…9.8
• CVE-2025-7697The Integration for Google Sheets and Contact Form 7, WPForm…9.8
• CVE-2025-7698Out-of-bounds read vulnerabilities in print processing of Ge…5.9
• CVE-2025-7700A flaw was found in FFmpeg’s ALS audio decoder, where it doe…5.3
• CVE-2025-7702URL Redirection to Untrusted Site ('Open Redirect') vulnerab…4.7
• CVE-2025-7703Authentication vulnerability in the mobile application（tech.…3.1
• CVE-2025-7704Supermicro BMC Insyde SMASH shell program has a stacked-bas…5.4
• CVE-2025-7705: Active Debug Code vulnerability in ABB Switch Actuator 4 D…8.6
• CVE-2025-7706Missing Authentication for Critical Function vulnerability i…6.1