CVE-2025-12523

MediumCVSS 6.5/10Last modified Nov 4, 2026

Description

Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
CentreonCentreon>= 24.10, < centreon-web-25.10.6; >= 24.04, < centreon-web-24.10.21; >= 25.10.x, < centreon-web-24.04.25

References

Timeline

Published
Oct 29, 2026
Last modified
Nov 4, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-125245.4The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due toCVE-2025-125255.3The Locker Content plugin for WordPress is vulnerable to Sensitive Information Exposure in version 1.0.0 via the 'lockerco_submit_post' AJAXCVE-2025-125264.3The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on thCVE-2025-125274.3The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydCVE-2025-125288.1The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the format_clCVE-2025-125298.8The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deCVE-2025-12537.8Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Stack-based Buffer Overflow vulnerability in RTI Connext ProfessionaCVE-2025-125305.9IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through Patch 1 transmits data in clear text that could allow an attacker to obtainCVE-2025-125319.1IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XCVE-2025-125355.3The SureForms plugin for WordPress is vulnerable to Cross-Site Request Forgery Bypass in all versions up to, and including, 1.13.1. This is CVE-2025-125365.3The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srCVE-2025-125376.4The Addon Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.1
CVE-2025-12523: Medium severity, CVSS 6.5 | Vulnix