CVE-2025-10719

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Tronclass developed by WisdomGarden has an Insecure Direct object Reference vulnerability, allowing remote attackers with regular privilege to modify a specific parameter to access other users' files.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Sep 19, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-10726.5A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior CVE-2025-107206.5The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control CVE-2025-107215.3A vulnerability was determined in Webull Investing & Trading App 11.2.5.63 on Android. This vulnerability affects unknown code of the file A CVE-2025-107225.3A vulnerability was detected in SKTLab Mukbee App 1.01.196 on Android. This affects an unknown function of the file AndroidManifest.xml of t CVE-2025-107232.7The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to functi CVE-2025-107259.9A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data s CVE-2025-107269.1The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. T CVE-2025-107275.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArkSigner Software and Hardware CVE-2025-107289.4When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading to stack overflow DoS CVE-2025-107299.4The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be acces CVE-2025-10737.5Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware ont CVE-2025-107306.5The Wp tabber widget plugin for WordPress is vulnerable to SQL Injection via the 'wp-tabber-widget' shortcode in all versions up to, and inc