CVE-2025-26523

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoints handling addition and deletion operations. Successful exploitation of this vulnerability could allow an authenticated remote attacker to modify information belonging to other user accounts.

Metrics

CVSS 4.0 7.4/10

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-265245.1This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpoints. An authenticat CVE-2025-265258.6Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as tho CVE-2025-265266.5Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback ac CVE-2025-265275.3Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.CVE-2025-265286.1The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.CVE-2025-265296.1Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.CVE-2025-26534.3A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulati CVE-2025-265306.1The question bank filter required additional sanitizing to prevent a reflected XSS risk.CVE-2025-265315.3Insufficient capability checks made it possible to disable badges a user does not have permission to access.CVE-2025-265324.3Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.CVE-2025-265339.8An SQL injection risk was identified in the module list filter within course search.CVE-2025-265348.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path