CVE-2025-49901Critical· 9.8▾ AbyssalPoC availableAuthentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1.
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
1 GitHub repo (last check)
Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-10294Critical· 9.8The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4
CVE-2025-8359Critical· 9.8The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9
CVE-2025-9967Critical· 9.8The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7
CVE-2025-57819Critical· 9.8FreePBX is an open-source web-based graphical user interface
CVE-2026-82269High· 8.1Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware
CVE-2026-58269High· 8.1Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing