275 matches found
EUVD-2026-117149
VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted msessionid tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to...
CVE-2026-54375
VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted msessionid tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to...
CVE-2026-54375
The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is vulnerable to an insecure session management flaw. The application stores unencrypted m_session_id tokens in application backups, which remain valid for ten years. An attacker capable of accessing these backups can inte...
PT-2026-137200
Name of the Vulnerable Software and Affected Versions VitaFit Android application versions prior to 2.8.1.0 Description Insecure session management allows the extraction or interception of unencrypted m session id tokens stored in application backups. These tokens remain valid for ten years,...
CVE-2024-56924
CVE-2024-56924 Vulnerability Description A Cross-Site Request Forgery CSRF vulnerability exists in the code astro Internet Banking System version 2.0.0, which allows remote attackers to perform unauthorized actions on behalf of authenticated users, such as administrators, without their knowledge...
EUVD-2026-109423
Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their ow...
EUVD-2026-99022
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUse...
CVE-2026-108951
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...
CVE-2026-108951 LavaLite CMS through 10.1.2 Authorization Bypass via User Update API
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...
EUVD-2026-97358
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...
CVE-2026-108951: Incorrect Authorization
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...
BIT-GHOST-2026-103266 Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...
PT-2026-108946
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication...
CVE-2026-103266 Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...
WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion vulnerability
Hydra Host+ Cross-Host Account Modification and Deletion vulnerability discovered by Stefan Spasic in WordPress Plugin Hydra Booking versions 1.2.4...
CVE-2026-14850
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...
CVE-2026-14850 Weak password recovery mechanism for forgotten password in MobiAPParc
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...
EUVD-2026-81522
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...
CVE-2026-14850 Weak password recovery mechanism for forgotten password in MobiAPParc
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...
CVE-2026-14850: Weak Password Recovery Mechanism for Forgotten Password
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...