CVE-2025-54943 CRITICAL

CVE-2025-54943: SUNNET Corporate Training Management System - Missing Authorization

Vendor Sunnet Technology Co., Ltd.
Product Corporate Training Management System
Weakness CWE-862 · Missing authorization
Published August 30, 2025
Last update January 30, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks.

Key dates

02Disclosure timeline

August 30, 2025 CVE published
January 30, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-1307 Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2025-31816 WordPress Mobile App Canvas Plugin <= 3.8.2 - Broken Access Control vulnerability CVE-2026-25460 WordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerability CVE-2025-31909 WordPress Apptivo Business Site CRM plugin <= 5.3 - Arbitrary Content Deletion vulnerability CVE-2026-27042 WordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerability