CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 6.1. See the original NVD description below for full technical details.
CVE
CVE-2025-43926
Severity
MEDIUM
CVSS
6.1
EPSS
0.21%
Original NVD Description
An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other function calls, which then might use these keys/values to affect permissions or other settings.
Related CVEs
Other vulnerabilities affecting the same vendor(s)