CVE-2025-3960

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in withstars Books-Management-System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /allreaders.html of the component Background Interface. The manipulation leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Apr 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-396004.3Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for WooCommerce and QuickBooks wp-woocommerce-quickbooks allows Cro CVE-2025-396019.6Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Custom CSS, JS & PHP custom-css allows Remote Code Inclusion.This issue affects CVE-2025-396024.3Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite wc-product-table-lite allows Exploiting Incorrectly C CVE-2025-39614.1A vulnerability classified as problematic has been found in withstars Books-Management-System 1.0. This affects an unknown part of the file CVE-2025-39624.1A vulnerability classified as problematic was found in withstars Books-Management-System 1.0. This vulnerability affects unknown code of the CVE-2025-39639.8A vulnerability, which was classified as critical, has been found in withstars Books-Management-System 1.0. This issue affects some unknown CVE-2025-39644.3A vulnerability, which was classified as problematic, was found in withstars Books-Management-System 1.0. Affected is an unknown function of CVE-2025-39655.4A vulnerability has been found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this vulnerability is an unknown funct CVE-2025-39665.3A vulnerability was found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this issue is some unknown functionality of CVE-2025-396638.4Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code CVE-2025-396646.5Insufficient escaping in the report scheduler within Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46 and 2.1.0 (EOL) allows authenticated attackers CVE-2025-396655.3User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to enumerate Checkmk usernames.