CVE-2025-9062

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection.

This issue affects Envanty: before 1.0.6.

NOTE: The vendor was contacted early about this disclosure but did not respond in any way. The vulnerability was learned to be remediated through reporter information and testing.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-90639.8An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vu CVE-2025-90649.1A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as th CVE-2025-90658.8A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. CVE-2025-90668.7A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can CVE-2025-90677.8A security issue exists within the x86 Microsoft Installer File (MSI), installed with FTLinx. Authenticated attackers with valid Windows use CVE-2025-90687.8A security issue exists within the Rockwell Automation Driver Package x64 Microsoft Installer File (MSI) repair functionality, installed wit CVE-2025-90712.3Erroneously using an all-zero seed for RSA-OEAP padding instead of the generated random bytes, in Oberon microsystems AG’s Oberon PSA Crypto CVE-2025-90725.4Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker CVE-2025-90737.5The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including CVE-2025-90749.3A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configur CVE-2025-90756.4The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to, and includ CVE-2025-90766.5Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows ma