CWE-266 vulnerabilities

A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTrackedConversation of the file src/managers/ChannelBridge.ts of the component Contact Tracking. This manipulation of the argument _channelType causes improper authorization. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48. It is suggested to install a patch to address this issue.

A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of the component User Registration Endpoint. This manipulation of the argument role causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel.

A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.

Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.

Unauthenticated Privilege Escalation in Easy Elements for Elementor &#8211; Addons &amp; Website Templates <= 1.4.9 versions.

Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.

Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions.

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships.

Multiple security vulnerabilities have been identified and fixed in Mozilla Thunderbird, including sandbox escapes, information disclosure, memory safety bugs, denial-of-service, privilege escalation, mitigation bypasses, and boundary condition errors. These issues affect Thunderbird ESR 140.12 and related Firefox versions. Red Hat has released security updates for Thunderbird in Red Hat Enterprise Linux 9.6 Extended Update Support to address these vulnerabilities.

Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.

Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.

Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1.

Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.

Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.

CVE-2025-69179 is a critical vulnerability in Theme passion's Support Ticket Management System versions 1.9 and earlier. It allows unauthenticated users to escalate privileges incorrectly due to improper privilege assignment. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. Users of affected versions should monitor vendor advisories for updates and consider mitigating exposure until a fix is released.

Subscriber Privilege Escalation in Genemy <= 1.6.6 versions.

Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions.