CVE-2025-70141

SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in adminclass.php based on the action parameter. An unauthenticated remote attacke...

Saturn Remote Mouse Server 访问控制错误漏洞

Saturn Remote Mouse Server is a remote mouse server developed by Saturn Remote Corporation. The Saturn Remote Mouse Server has an access control vulnerability, which stems from a command injection vulnerability. This vulnerability allows unverified attackers to execute arbitrary commands by sendi...

Rongzhitong Visual Integrated Command and Dispatch Platform 访问控制错误漏洞

Rongzhitong Visual Integrated Command and Dispatch Platform is an integrated command system for emergency management and public safety developed by Rongzhitong Corporation. The Rongzhitong Visual Integrated Command and Dispatch Platform versions 20260206 and earlier contained a access control...

Rongzhitong Visual Integrated Command and Dispatch Platform 访问控制错误漏洞

Rongzhitong Visual Integrated Command and Dispatch Platform is an integrated command system for emergency management and public safety developed by Rongzhitong Corporation. The Rongzhitong Visual Integrated Command and Dispatch Platform versions 20260206 and earlier contained a access control...

Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs

Summary A broken access control vulnerability in Gogs allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI internal/route/repo/issue.go fails to verify that the label being modified belongs to the...

Security Bulletin: File permission modification, improper access control, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to file permission modification, improper access control, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-24049 DESCRIPTION: wheel is a command line tool for manipulating Python wheel files, ...

WordPress plugin Smart Forms 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the admin/login process. An attacker can gain unauthorized access to administrative backend functionality by leveraging insufficient role-based access control checks during authentication. This is only...

WordPress plugin AdForest 访问控制错误漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Vaultwarden 安全漏洞

Vaultwarden is an alternative implementation of the Bitwarden server API, developed by Daniel García using Rust. Versions of Vaultwarden prior to 1.35.3 contained a security vulnerability. This vulnerability stemmed from improper access control for endpoints, ciphers, and organization-details,...

CVE-2025-48514

Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting in a loss of confidentiality...

CVE-2025-48514

CVE-2025-48514 concerns insufficient granularity of access control in AMD SEV firmware, enabling a privileged attacker to create a SEV-ES Guest that can attack an SNP guest and potentially lead to a confidentiality loss. The description is consistent across multiple feeds (Red Hat, Debian OSV, NV...

CVE-2026-21238

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-21238

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators

A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the syste...

CVE-2026-24900

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses//assignments//submissions/htmlcontent accepted a selectfileid parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correct...

CVE-2026-25231 FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control

FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this directory can be accessed directly by any user who knows or...

Adminer 访问控制错误漏洞

Adminer is an open-source WordPress plugin developed by Adminer. It allows WordPress administrators to perform database management tasks more efficiently. Versions of Adminer prior to 2.2.1 contained a security vulnerability related to access control. This vulnerability stemmed from the fact that...

FUXA 访问控制错误漏洞

FUXA is a web-based process visualization software developed by frangoteam. Versions of FUXA 1.2.9 and earlier contained a security vulnerability related to access control. This vulnerability was caused by path traversal attacks, which could allow unverified remote attackers to write arbitrary...

Tenda AC21 访问控制错误漏洞

Tenda AC21 is a wireless router produced by the Chinese company Tenda. The Tenda AC21 version 16.03.08.16 has a vulnerability related to access control. This vulnerability stems from incorrect handling of the /cgi-bin/DownloadFlash file, which may lead to information leakage...