CVE-2026-125297
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A r
CVSS
9.8
Critical
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-306 · CWE-862
Not enough EPSS history yet.
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.
- github.comhttps://github.com/trevorkaon/vulnerability-security-research/blob/main/advisories/asiainfo/CVE-2026-125297.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-03.json
- www.asiainfo.euhttps://www.asiainfo.eu/cloudbss
- www.cve.orghttps://www.cve.org/CVERecord?id=CVE-2026-125297
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1265454.3 MED—
———WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing.5hCVE-2026-0480——
———Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to forge SEV-TIO guest request messages potentially compromising SEV-SNP guest memory integrity and confidentiality.7hCVE-2026-91000——
———Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation.
This issue affects N-central: before 2026.4.1.8hCVE-2026-1261236.5 MED—
———BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data.8hCVE-2026-1208256.5 MED—
———An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.8hCVE-2026-1208234.3 MED—
———A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in unintended access to configuration and schema information.8h