CVE-2025-5526

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jun 27, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-552619.8HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compCVE-2025-552627.5HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from CVE-2025-552637.5HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in inCVE-2025-552645.5HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they caCVE-2025-552657.5HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files present in the systCVE-2025-552666.5HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized tCVE-2025-552679.8HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining CVE-2025-552685.3HCL Aftermarket DPC is affected by Spamming Vulnerability which can allow the actor to excessive spamming can consume server bandwidth and pCVE-2025-552699.8HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use brCVE-2025-55278.8A vulnerability was found in Tenda RX3 16.03.13.11_multi_TDE01. It has been rated as critical. This issue affects the function save_staticroCVE-2025-552709.8HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to inject executable code and can carry out attacks suCVE-2025-552718.8HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split res
CVE-2025-5526: Medium severity, CVSS 4.3 | Vulnix