CVE Vulnerability Advisory Database

[Affected Scope] Presenton versions up to and including 0.9.11-beta

[Impact] Missing authentication in the API component allows remote attackers to access critical functions and manipulate data without authorization

[Mitigation] Immediately upgrade the affected component to version 0.9.12-beta or later

[Affected Scope] LearnHouse versions prior to 1.1.1

[Impact] Authenticated users can exploit missing authorization checks to read other users' grades, submissions, and instructor feedback

[Mitigation] Immediately upgrade LearnHouse to version 1.1.1 or higher and enforce strict API access control policies

[Affected Scope] All IXP Manager installations prior to version 7.3.0.

[Impact] Authenticated attackers can view or modify API keys belonging to other users, potentially leading to full administrative takeover of the IXP infrastructure.

[Mitigation] Immediately upgrade IXP Manager to version 7.3.0 or later.

[Affected Scope] All AhsayCBS installations running versions up to 9.15.2.69 and 10.3.4.44.

[Impact] Unauthenticated remote attackers can bypass the system password verification logic to gain full administrative access to the backup server.

[Mitigation] Immediately upgrade to version 9.15.2.70, 10.3.4.45, or later as per vendor instructions.

[Affected Scope] Appsmith versions 1.94 and below with publicly accessible applications

[Impact] Unauthenticated attackers can execute unpublished (edit-mode) actions, leading to sensitive data exposure, unauthorized database queries, and side-effect behaviors

[Mitigation] Restrict public access to applications and implement request filtering on reverse proxies or WAFs to block unauthorized edit-mode execution requests

[Affected Scope] Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and prior

[Impact] Unauthenticated remote attackers can bypass authentication via the API component to access protected resources and sensitive data without credentials

[Mitigation] Immediately apply the official vendor security patches and restrict external access to the API endpoints

[Affected Scope] Cisco Smart Licensing Utility (CSLU) versions prior to 2.3.0

[Impact] Unauthenticated remote attackers can gain full administrative access to the CSLU application API using hardcoded static credentials

[Mitigation] Immediately upgrade CSLU to version 2.3.0 or later, and restrict external access to the CSLU API ports using firewalls

[Affected Scope] Twilio Authy API endpoints accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0

[Impact] Unauthenticated attackers can verify whether specific phone numbers are registered with Authy, enabling large-scale enumeration and targeted phishing/social engineering attacks

[Mitigation] Immediately update mobile applications to the latest versions (Android 25.1.0+ / iOS 26.1.0+) and enforce strict rate limiting on API gateways

[Affected Scope] Ivanti EPMM (Endpoint Manager Mobile) 11.10 and older, and MobileIron Core 11.2 and older

[Impact] Unauthenticated remote attackers can bypass authentication to access restricted API endpoints, compromise sensitive data, or execute arbitrary commands

[Mitigation] Immediately upgrade to the latest supported release and restrict external access to administrative API endpoints

[Affected Scope] All Strapi deployments running version 4.5.5 or earlier.

[Impact] Authenticated attackers with admin panel access can leak sensitive user data, including password hashes and reset tokens, via side-channel inference.

[Mitigation] Immediately upgrade Strapi to version 4.6.0 or later.

[Affected Scope] Joomla! versions 4.0.0 through 4.2.7

[Impact] Unauthenticated remote attackers can bypass access controls to access sensitive API endpoints, exposing database credentials and system configuration details

[Mitigation] Immediately upgrade Joomla! to the patched version (4.2.8 or higher) and rotate all database credentials