CVE-2025-9954

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Oct 30, 2025
Last modified
Oct 8, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-99555.7An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internaCVE-2025-99572.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.CVE-2025-99587.7An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, thCVE-2025-99597.6Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smoCVE-2025-99606.9A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF). This issue affectCVE-2025-99618.6An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500.  The exploit can only be CVE-2025-996210.0A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication.This issue affectsCVE-2025-99639.4A path traversal vulnerability in Novakon P series allows to expose the root file system "/" and modify all files with root permissions. ThiCVE-2025-99648.6No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P CVE-2025-99659.3Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to thCVE-2025-99667.3Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This CVE-2025-99679.8The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and in
CVE-2025-9954: High severity, CVSS 7.5 | Vulnix