CVE-2026-108521 Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

EUVD-2026-96728

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

CVE-2026-108521

A server-side request forgery (SSRF) vulnerability exists in Studio-Saelix Sencho up to version 0.97.1 . The flaw is located in the isValidRemoteUrl function within the backend/src/utils/validation.ts file of the Add Remote Node API Endpoint component. An authenticated user with node-management p...

CVE-2026-108704

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...

EUVD-2026-96704

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...

CVE-2026-108704 CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...

CVE-2026-108704

CordysCRM through version 1.9.3 is affected by an authorization bypass vulnerability (CWE-639). Low-privileged authenticated users can bypass permission checks by setting the owner field to their own user ID. By sending requests to the follow/record/add endpoints, an attacker can add follow-up re...

CVE-2026-108704 CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...

EUVD-2026-96572

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button...

EUVD-2026-96556

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes...

CVE-2026-84259: Improper Neutralization of Input During Web Page Generation

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

PT-2026-110028

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to WPForms versions prior to 1.0.4 Description The add-on lacks authorization and Cross-Site Request Forgery CSRF checks when updating options via a REST endpoint. Additionally, it fails to verify if the option being updated...

PT-2026-110111

Name of the Vulnerable Software and Affected Versions Konstanty Bialkowski libmodplug versions prior to 0.8.9.2 Description An issue exists in the ABC Music Format Parser component within the abc add gchord function of the src/load abc.cpp file. A remote attacker can trigger excessive resource...

PT-2026-110029

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Gravity Forms versions prior to 1.0.4 Description The plugin lacks authorization and Cross-Site Request Forgery CSRF checks when updating options through a REST endpoint. Additionally, it fails to verify if the option bein...

CVE-2026-108521: Server-Side Request Forgery (SSRF)

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

PT-2026-110031

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Ninja Forms WordPress plugin versions prior to 1.0.2 Description An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Site...

CVE-2026-108704: Authorization Bypass Through User-Controlled Key

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...

PT-2026-110000

Name of the Vulnerable Software and Affected Versions Studio-Saelix Sencho versions prior to 0.97.1 Description An issue exists in the Add Remote Node API Endpoint component within the isValidRemoteUrl function of the backend/src/utils/validation.ts file. An authenticated user with node-managemen...

PT-2026-109995

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.9.4 Description An authorization bypass allows low-privileged authenticated users to circumvent permission checks by assigning their own user ID to the owner field. This enables attackers to send requests to the...

CVE-2026-108633

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button...