CVE-2024-50633

CVE-2024-50633 🏆 - CVE-2024-50633 : Indico BOLA Vulnerability Discovered and reported a BOLA vulnerability in Indico. 📜 Description CVE-2024-50633 A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive user information by manipulating API...

CVE-2026-65013-BOLA-IDOR

CVE-2026-65013-BOLA-IDOR PoC reproducible deBOLA / IDOR en la API tRPC de Onlook CVE-2026-65013. Cualquier usuario autenticado puede leer, modificar y borrar proyectos, miembros e historial de IA de otros usuarios con solo pasar sus UUID a los procedimientos tRPC versiones = 0.2.32. | ---|--- CVE...

CVE-2026-14871

CVE-2026-14871 - BOLA / IDOR in osTicket ajax.tickets.php Broken Object Level Authorization BOLA: Insecure Direct Object Reference IDOR include/ajax.tickets.php → viewField function Reported by @JF0x0r · March 27, 2026 Status: PATCHED - Fix released in osTicket v1.17.8 / v1.18.4 At a Glance Field...

bola-CVE-2023-27524

bola-CVE-2023-27524 📄 README.md — Proyecto de demostración BOLA CVE-2023-27524 🔐 Demostración de Autorización a Nivel de Objeto Roto BOLA Análisis de Seguridad y Corrección de CVE-2023-27524 --- 📌 Resumen del Proyecto Este proyecto demuestra una vulnerabilidad real de Autorización a Nivel de Obje...

CVE-2023-33730

CVE-2023-33730 — Escalada de Privilegios en eScan Management Console Severidad: Crítica ID CVE: CVE-2023-33730 Divulgado: 30 de mayo de 2023 Autor: Sahil Ojha Tabla de Contenidos Overview Vulnerability Details Impact Technical Analysis Proof of Concept Remediation References Disclaimer Descripció...

CVE-2025-53640

CVE-2025-53640 – Enumeración de Usuarios Autenticados en Indico de CERN Vulnerabilidad BOLA PoC y análisis técnico de CVE-2025-53640: una vulnerabilidad de Autorización a Nivel de Objeto Rota BOLA en Indico permite la enumeración de usuarios autenticados a través de un endpoint, exponiendo nombre...

CVE-2026-30944-PoC

🔓 CVE-2026-30944 Escalada de Privilegios en StudioCMS mediante Generación Insegura de Tokens API NVD • Advisory • CWE-639 Resumen El endpoint POST /studiocmsapi/dashboard/api-tokens en StudioCMS ≤ 0.3.0 permite que cualquier usuario autenticado como mínimo con rol Editor genere tokens API para...

CVE-2026-24134-PoC

CVE-2026-24134-PoC Descripción general Este repositorio contiene la Prueba de Concepto PoC para CVE-2026-24134 , una vulnerabilidad de Autorización Rota a Nivel de Objeto BOLA en StudioCMS. Contenido cve202624134poc.py - Script de explotación en Python Requisitos previos StudioCMS=0.1.1 pip...

akto v2.34.7

Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

Exploit for CVE-2026-65013

CVE-2026-65013-BOLA-IDOR PoC reproducible de BOLA / IDOR...

CVE-2026-85611 OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

CVE-2026-85611

OpenPanel versions before 2.3.0 are affected by a cross-tenant Broken Object Level Authorization (BOLA) vulnerability in the report.getLayouts and report.resetLayout tRPC procedures. The root cause is that these procedures fail to scope dashboard queries to the caller's own project, allowing an a...

CVE-2026-85611 OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

PT-2026-85507

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

CVE-2026-51956

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/id endpoint. The application does not enforce tenant-level...

PT-2026-84360

Name of the Vulnerable Software and Affected Versions Grashjs Atlas CMMS versions prior to 1.6.0 Description A Broken Object Level Authorization issue allows an authenticated user from one tenant to read and modify the company record of another tenant. This occurs because the application fails to...

CVE-2026-51956

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/id endpoint. The application does not enforce tenant-level...

CVE-2026-51956

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0 . The root cause is a failure to enforce tenant-level ownership checks when accessing or updating company objects via the /company/{id} endpoint. An authenticated user from one tenant can read and modif...