PT-2025-5882 · Codeastro · Codeastro Complaint Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro Complaint Management System version 1.0 Description: The issue concerns incorrect access control in the endpoint "/admin/m delete.php" that allows unauthorized attackers to delete complaints arbitrarily by modifying the id parameter...

CVE-2024-54369

Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through = 1.0.2...

CVE-2024-23920 ChargePoint Home Flex Improper Access Control

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the onboardee module. The issue results from improper...

CVE-2025-0743

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint "/embedai/visits/show/" to obtain information about the visits made by other users. The information provided by this endpoint includes IP...

EmbedAI 安全漏洞

EmbedAI is a platform from EmbedAI that enables users to use their data to create AI chatbots powered by ChatGPT. A security vulnerability exists in EmbedAI version 2.1 and prior versions that stems from improper access control...

CVE-2023-37412

IBM Aspera Faspex 5.0.0 through 5.0.10 could allow a privileged user to make system changes without proper access controls...

Advisory ROSA-SA-2025-2630

software: libde265 1.0.14 OS: ROSA-CHROME packageevrstring: libde265-1.0.14-1 CVE-ID: CVE-2021-36410 BDU-ID: 2023-01688 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the putepelhvfallback function of the fallback-motion.cc component of the h.265 Libde265 video codec implementation is related to...

Advisory ROSA-SA-2025-2631

software: libheif 1.12.0 WASP: ROSA-CHROME packageevrstring: libheif-1.12.0-4 CVE-ID: CVE-2021-36410 BDU-ID: 2023-01688 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the putepelhvfallback function of the fallback-motion.cc component of the h.265 Libde265 video codec implementation is related to...

ROS-20250128-07

A vulnerability in the HID Profile Human Interface Device interface of the Bluetooth protocol stack for the Linux BlueZ operating system is related to an access control flaw. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary commands...

CVE-2025-24603 WordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin <= 3.4.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in Dmitry V. CEO of "UKR Solution" Print Barcode Labels for your WooCommerce products/orders a4-barcode-generator.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through = 3.4.10...

Vaultwarden 访问控制错误漏洞

Vaultwarden is an alternative implementation of the Bitwarden server API written in Rust by Daniel García Personal Developer. Vaultwarden suffers from an access control error vulnerability that stems from the fact that an attacker can gain ownership of another organization by knowing the victim...

BYD QIN PLUS DM-i with Dilink OS 安全漏洞

BYD QIN PLUS DM-i with Dilink OS is a plug-in hybrid electric sedan with Dilink OS from BYD China. A security vulnerability exists in BYD QIN PLUS DM-i with Dilink OS version 3.013.1.7.2204050.1, which originates from a faulty access control that allows an unauthorized attacker to access system...

Microsoft Edge’s vulnerability, related to deficiencies in access control, allows attackers to escalate their privileges.

The vulnerability of Microsoft Edge relates to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2025-5428 · Ninja Team · Ninjateam Gdpr Ccpa Compliance Support

Name of the Vulnerable Software and Affected Versions: NinjaTeam GDPR CCPA Compliance Support versions 2.7.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

The vulnerability of the Microsoft Visual Studio software development tool lies in its lack of access control mechanisms, which allows attackers to escalate their privileges.

The vulnerability of the Microsoft Visual Studio software development tool is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management, related to improper access control, allows a intruder to gain unauthorized access to the account.

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to improper access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the user account...

CVE-2024-57681

An access control issue in the component form2alg.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request...

CVE-2024-57677

CVE-2024-57677 describes an access-control flaw in the D-Link 816A2 DIR-816 firmware (form2Wan.cgi) that allows unauthenticated attackers to configure the device’s WAN service via a crafted POST request. Root cause per documents: improper access control on the form2Wan.cgi endpoint, enabling mani...

D-Link DIR-816 安全漏洞

The D-Link DIR-816A2 is a router from China's AUO D-Link. The D-Link DIR-816A2 suffers from an Access Control Error vulnerability that stems from improper access control in the form2PortriggerRule.cgi component, which can be exploited by an unauthenticated attacker to set a port trigger via a...

D-Link DIR-816 安全漏洞

The D-Link DIR-816A2 is a router from China's AUO D-Link. The D-Link DIR-816A2 suffers from an Access Control Error vulnerability that stems from improper access control of the form2Wan.cgi component, which can be exploited by an unauthenticated attacker to set up WAN services via a specially...