CVE-2025-45611

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET request.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
May 5, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-456129.8Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index.CVE-2025-456137.5Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payCVE-2025-456147.5Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payloCVE-2025-456159.8Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted requeCVE-2025-456169.8Incorrect access control in the /admin/** API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request.CVE-2025-456177.5Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via CVE-2025-456186.5Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to accCVE-2025-456196.5An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction functionCVE-2025-456208.1An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted requestCVE-2025-45632.7A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. CVE-2025-45649.8The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validatiCVE-2025-45655.3Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive grou
CVE-2025-45611: Critical severity, CVSS 9.8 | Vulnix