CVE-2026-25806 PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR)

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do...

CVE-2026-24421

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any authenticated user despite their permissions. SetupController.php uses userIsAuthenticated but does not verify that the requester has...

CVE-2024-5891

A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the application was created. This issue is limited to authentication and not authorization. However, ...

PT-2024-37226 · Quay · Quay

Name of the Vulnerable Software and Affected Versions: Quay affected versions not specified Description: A vulnerability was found in Quay, where an attacker can use an OAuth token to authenticate despite not having access to the organization from which the application was created, if they obtain...

CVE-2023-35794

An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint spawned console can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only Basic Authentication to the SSH console...

CVE-2021-3956: Incorrect Authorization

A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller XCC firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active...

PT-2022-10923

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Controller XCC firmware affected versions not specified Description A read-only authentication bypass issue was reported in Lenovo XClarity Controller XCC firmware. This issue affects XCC devices configured in LDAP Authenticati...

CVE-2019-6195: Improper Privilege Management

An authorization bypass exists in Lenovo XClarity Controller XCC versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1 “LDAP Authentication Only with Local...

PT-2020-11198

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Controller versions prior to 3.08 CDI340V Lenovo XClarity Controller versions prior to 3.01 TEI392O Lenovo XClarity Controller versions prior to 1.71 PSI328N Description An authorization bypass exists where a valid authenticate...