EUVD-2023-44558

Malicious code in bioql PyPI...

EUVD-2024-36822

Malicious code in bioql PyPI...

EUVD-2023-12658

Malicious code in bioql PyPI...

EUVD-2024-43452

Malicious code in bioql PyPI...

EUVD-2023-57355

Malicious code in bioql PyPI...

EUVD-2022-4547

Malicious code in bioql PyPI...

EUVD-2025-31743

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-4050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin...

CGM CLININET Trust Management Issue Vulnerability

CGM CLININET is a hospital information management system from CGM Germany. CGM CLININET suffers from a trust management issue vulnerability that stems from the decodeParam function not verifying the signature algorithm, which can be exploited by an attacker to generate arbitrary user sessions...

CVE-2025-30064

An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to genera...

CVE-2025-30064

Technical details about CVE-2025-30064 are not publicly provided in the supplied connected documents. Monitor for updates from official advisories; current sources do not reveal affected products, versions, or remediation steps.

CVE-2025-30064 Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key

An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to genera...

CVE-2025-30064 Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key

An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to genera...

Linux Distros Unpatched Vulnerability : CVE-2025-46801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an...

CVE-2025-9254 Uniong｜WebITR - Missing Authentication

WebITR developed by Uniong has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to log into the system as arbitrary users by exploiting a specific functionality...

WebITR 访问控制错误漏洞

WebITR is a poor attendance system from WebITR Corporation of Taiwan, China. WebITR suffers from an access control error vulnerability that stems from a lack of authentication, which could allow an unauthenticated remote attacker to log in to the system as an arbitrary user...

PT-2025-34341 · Uniong · Webitr

Name of the Vulnerable Software and Affected Versions: WebITR versions affected versions not specified Description: WebITR developed by Uniong suffers from a missing authentication issue. This allows unauthenticated remote attackers to log into the system as arbitrary users by exploiting a specif...

CVE-2025-55736

CVE-2025-55736 affects flaskBlog up to version 2.8.0 (and earlier). The root cause is in the routes/adminPanelUsers file, where an arbitrary user can elevate their role to admin , gaining high-privilege capabilities (e.g., delete users, posts, comments). Connected sources confirm the affected sof...

FlaskBlog 安全漏洞

FlaskBlog is a simple blogging application built using Flask by Doğukan Ürker, an individual developer. A security vulnerability exists in FlaskBlog 2.8.0 and earlier versions, which stems from the fact that an arbitrary user may be elevated to the administrator role...

PT-2025-33854 · Flaskblog · Flaskblog

Name of the Vulnerable Software and Affected Versions: flaskBlog versions prior to 2.8.1 Description: flaskBlog is a blog app built with Flask. An arbitrary user can change their role to "admin", granting administrative privileges such as deleting users, posts, and comments. The issue resides in...