CVE-2025-15490

MediumCVSS 5.3/10Last modified Oct 19, 2026

Description

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-154915.5The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to inc CVE-2025-154928.8A vulnerability was detected in RainyGao DocSys up to 2.02.36. The affected element is an unknown function of the file src/com/DocSystem/map CVE-2025-154939.8A flaw has been found in RainyGao DocSys up to 2.02.36. The impacted element is an unknown function of the file src/com/DocSystem/mapping/Re CVE-2025-154948.8A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSystem/mapping/UserMapp CVE-2025-154957.2A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulati CVE-2025-154969.8A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulat CVE-2025-154973.8Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resultin CVE-2025-154989.3Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated atta CVE-2025-154999.8A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8. This vulnerability affects the function u CVE-2025-15509.8The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .k CVE-2025-155009.8A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some unknown processing of CVE-2025-155019.8A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the function WriterHandle.get