CVE-2025-59945

HighCVSS 8.1/10Last modified Oct 9, 2026

Description

SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published
Sep 27, 2025
Last modified
Oct 9, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-599467.5NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. Prior to version 0.24.2, there is a classical data racing issue about sub info liCVE-2025-599479.0NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger CVE-2025-599485.4FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed contentCVE-2025-599496.5FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lCVE-2025-59954.6Canon EOS Webcam Utility Pro for MAC OS version 2.3d (2.3.29) and earlier contains an improper directory permissions vulnerability. ExploitaCVE-2025-599505.4FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmatCVE-2025-599519.1Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image forCVE-2025-599528.7MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storagCVE-2025-599539.8LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, CVE-2025-599549.8Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection througCVE-2025-599555.7Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including CVE-2025-599566.5AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS