CVE-2025-43926

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other function calls, which then might use these keys/values to affect permissions or other settings.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-439289.8In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal CVE-2025-439297.8open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked f CVE-2025-43936.5Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the serv CVE-2025-439309.8Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the CVE-2025-439319.8flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a re CVE-2025-439329.8JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depe CVE-2025-439339.8fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends CVE-2025-439346.0Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas CVE-2025-439354.4Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability. A high privileged attack CVE-2025-439369.1Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability. An unauthenticated attacker with CVE-2025-439376.6Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerability. A low privile CVE-2025-439384.4Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability. A high privi