CVE-2025-9062

Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection. This issue affects Envanty: before 1.0.6.   NOTE: The vendor was contacted early about this disclosure but did not respond in any way. The vulnerability was learned to be remediated through reporter information and testing.

• CWE-639

• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0076
• https://www.usom.gov.tr/bildirim/tr-26-0076

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9056Unprotected service in the AudioLink component allows a loca…5.3
• CVE-2025-9057The Biagiotti Core plugin for WordPress is vulnerable to Sto…6.4
• CVE-2025-9058The Mikado Core plugin for WordPress is vulnerable to Stored…6.4
• CVE-2025-9059The Altiris Core Agent Updater package (AeXNSC.exe) is prone…8.8
• CVE-2025-9060A vulnerability has been found in the  MSoft MFlash applic…9.1
• CVE-2025-9061The Wilmer Core plugin for WordPress is vulnerable to Stored…6.4
• CVE-2025-9063An authentication bypass security issue exists within Factor…9.8
• CVE-2025-9064A path traversal security issue exists within FactoryTalk Vi…9.1
• CVE-2025-9065A server-side request forgery security issue exists within R…8.8
• CVE-2025-9066A security issue was discovered within FactoryTalk® ViewPoin…8.7
• CVE-2025-9067A security issue exists within the x86 Microsoft Installer F…7.8
• CVE-2025-9068A security issue exists within the Rockwell Automation Drive…7.8