Exploit for CVE-2025-48757

cso-vibecheck Senior-CSO security audit skill for vibe-coded...

PT-2026-24619

Summary The /studiocms api/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target...

EUVD-2023-41876

Malicious code in bioql PyPI...

EUVD-2023-43963

Malicious code in bioql PyPI...

EUVD-2023-43960

Malicious code in bioql PyPI...

EUVD-2023-43962

Malicious code in bioql PyPI...

EUVD-2023-41874

Malicious code in bioql PyPI...

EUVD-2023-43961

Malicious code in bioql PyPI...

EUVD-2023-41877

Malicious code in bioql PyPI...

EUVD-2023-41875

Malicious code in bioql PyPI...

EUVD-2023-43964

Malicious code in bioql PyPI...

EUVD-2023-41878

Malicious code in bioql PyPI...

EUVD-2023-41879

Malicious code in bioql PyPI...

EUVD-2025-0088

Malicious code in bioql PyPI...

EUVD-2023-41880

Malicious code in bioql PyPI...

EUVD-2023-43965

Malicious code in bioql PyPI...

Closing the Loop on API Security: How Imperva Helps You Expose, Contain, and Mitigate Business Logic Threats

In a world powered by APIs, waiting for an attack is waiting too long. Business logic risks like Broken Object Level Authorization BOLA don’t announce themselves with obvious signatures or malware. They hide in plain sight within normal-looking traffic and by the time a BOLA exploit turns into a...

CVE-2023-38054

A BOLA vulnerability in GET, PUT, DELETE /customers/customerId allows a low privileged user to fetch, modify or delete a low privileged user customer. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38051

A BOLA vulnerability in GET, PUT, DELETE /secretaries/secretaryId allows a low privileged user to fetch, modify or delete a low privileged user secretary. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38055

A BOLA vulnerability in GET, PUT, DELETE /services/serviceId allows a low privileged user to fetch, modify or delete the services of any user including admin. This results in unauthorized access and unauthorized data manipulation...