CVE-2025-0670

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft ProKuafor allows Resource Leak Exposure.

This issue affects ProKuafor: from s1.02.07 before v1.02.08.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Sep 2, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-06716.1The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high priviCVE-2025-06723.8An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted,CVE-2025-06737.5An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2, CVE-2025-06749.8Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password managementCVE-2025-06757.5Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure.CVE-2025-06768.6This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to expCVE-2025-06776.4A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate the internal bufCVE-2025-06787.8A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the fiCVE-2025-06794.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. CVE-2025-06809.8Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take controlCVE-2025-06816.2The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive infCVE-2025-06828.8The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_