CVE-2024-56924

CVE-2024-56924 Vulnerability Description A Cross-Site Request Forgery CSRF vulnerability exists in the code astro Internet Banking System version 2.0.0, which allows remote attackers to perform unauthorized actions on behalf of authenticated users, such as administrators, without their knowledge...

EUVD-2026-109423

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their ow...

EUVD-2026-99022

Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUse...

CVE-2026-108951

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...

EUVD-2026-97358

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...

CVE-2026-108951 LavaLite CMS through 10.1.2 Authorization Bypass via User Update API

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...

CVE-2026-108951: Incorrect Authorization

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...

BIT-GHOST-2026-103266 Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...

PT-2026-108946

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication...

CVE-2026-103266 Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...

WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion vulnerability

Hydra Host+ Cross-Host Account Modification and Deletion vulnerability discovered by Stefan Spasic in WordPress Plugin Hydra Booking versions 1.2.4...

CVE-2026-14850

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

EUVD-2026-81522

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

CVE-2026-14850 Weak password recovery mechanism for forgotten password in MobiAPParc

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

CVE-2026-14850 Weak password recovery mechanism for forgotten password in MobiAPParc

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

PT-2026-94254

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

CVE-2026-14850: Weak Password Recovery Mechanism for Forgotten Password

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

Malicious code in jexkcode (npm)

Versions 1.0.1 through 1.1.4 of jexkcode automatically follow a hard-coded WhatsApp newsletter whenever a WhatsApp connection opens. The package waits three seconds and calls newsletterFollow without obtaining user consent or exposing a configuration option. The README advertises newsletter suppo...

Malicious code in jexkcode (npm)

Versions 1.0.1 through 1.1.4 of jexkcode automatically follow a hard-coded WhatsApp newsletter whenever a WhatsApp connection opens. The package waits three seconds and calls newsletterFollow without obtaining user consent or exposing a configuration option. The README advertises newsletter suppo...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the bulk delete process. An attacker can gain unauthorized access to and modify or disable accounts outside their permitt...