CVE Database

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a …

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call …

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat …

IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API …

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers …

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log …

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. …

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can …

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. …

Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. …

smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated …

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. …

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify …

FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. …

CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers …

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every …

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with …

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController …

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by …

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to …

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can …

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can …

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. …

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by …

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership …

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying …

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers …

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying …

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers …

PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. …

SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send …

IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.

IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.

Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port …

Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read …

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.

Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a …

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party …

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats …

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is …

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE …

Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do …

Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain …

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access …

MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave …

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an …

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated …

destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions …

PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field …

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within …