CVE-2025-9902

Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abuse. This issue affects QRMenu: from 1.05.12 before Version dated 05.09.2025.

• CWE-639

• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0333
• https://www.usom.gov.tr/bildirim/tr-25-0333

Published

Oct 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9896The HidePost plugin for WordPress is vulnerable to Cross-Sit…4.3
• CVE-2025-9897The AP Background plugin for WordPress is vulnerable to Cros…4.3
• CVE-2025-9898The cForms – Light speed fast Form Builder plugin for WordPr…4.3
• CVE-2025-9899The Trust Reviews plugin for Google, Tripadvisor, Yelp, Airb…6.1
• CVE-2025-9900A flaw was found in Libtiff. This vulnerability is a "write-…8.8
• CVE-2025-9901A flaw was found in libsoup’s caching mechanism, SoupCache, …5.9
• CVE-2025-9903Out-of-bounds write vulnerabilities in print processing of G…5.9
• CVE-2025-9904Unallocated memory access vulnerability in print processing …6.9
• CVE-2025-9905The Keras Model.load_model method can be exploited to achiev…7.3
• CVE-2025-9906The Keras Model.load_model method can be exploited to achiev…7.3
• CVE-2025-9907A flaw was found in the Red Hat Ansible Automation Platform,…6.7
• CVE-2025-9908A flaw was found in the Red Hat Ansible Automation Platform,…6.7