CVE-2025-25618

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teachers.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Mar 17, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-25625.4Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a storedCVE-2025-256205.4Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.CVE-2025-256214.3Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers. This affected eCVE-2025-256255.4A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and wCVE-2025-25638.1The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership AddonCVE-2025-256329.8Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.CVE-2025-256346.5A vulnerability has been found in Tenda AC15 15.03.05.19 in the function GetParentControlInfo of the file /goform/GetParentControlInfo. The CVE-2025-256358.0TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation CVE-2025-25644.3Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived cCVE-2025-25654.3The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.CVE-2025-256509.1An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards tCVE-2025-256527.5In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory
CVE-2025-25618: Low severity, CVSS 3.3 | Vulnix