CVE-2025-59133

HighCVSS 7.5/10Last modified Oct 12, 2026

Description

Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2026
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-591348.8Incorrect Privilege Assignment vulnerability in Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting immiex alloCVE-2025-591355.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager porCVE-2025-591365.3Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve EmbCVE-2025-591377.1Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSSCVE-2025-591384.9Server-Side Request Forgery (SSRF) vulnerability in Jthemes Genemy genemy allows Server Side Request Forgery.This issue affects Genemy: fromCVE-2025-591395.3Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the `bodyLimit` CVE-2025-59147.8A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flCVE-2025-591408.8backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishinCVE-2025-591418.8simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishiCVE-2025-591428.8color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken oveCVE-2025-591438.8color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over afCVE-2025-591448.8debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. V
CVE-2025-59133: High severity, CVSS 7.5 | Vulnix