The vulnerability of the cstecgi.cgi (/cgi-bin/cstecgi.cgi) script in the TOTOLINK A720R router’s microprogramming software allows a hacker to escalate their privileges.

The vulnerability of the cstecgi.cgi /cgi-bin/cstecgi.cgi script in the TOTOLINK A720R router software is related to errors in access control when processing the topicurl parameter. Exploiting this vulnerability allows a remote attacker to increase their privileges by sending specially crafted PO...

CVE-2025-28202

Incorrect access control in Victure RX1800 ENV1.0.0r12110933 allows attackers to enable SSH and Telnet services without authentication...

CVE-2025-46586

Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability...

The vulnerability of the bitmap_ip_uadt() function in the Google ChromeOS operating system allows a hacker to bypass security restrictions and execute arbitrary code.

The vulnerability of the bitmapipuadt function in the Google ChromeOS operating system is related to deficiencies in access control due to incorrect checking of IP address boundaries when processing the IPSETATTRCIDR parameter. Exploiting this vulnerability allows a remote attacker to bypass...

PT-2025-19782

Name of the Vulnerable Software and Affected Versions One version 1.0 Description The issue is related to incorrect access control in the component "/api/user/manager" that allows attackers to access sensitive information via a crafted payload. Recommendations For version 1.0, as a temporary...

PT-2025-19778 · Unknown · Passjava-Platform

Name of the Vulnerable Software and Affected Versions: PassJava-Platform version 3.0.0 Description: The issue is related to incorrect access control in the component "/scheduleLog/info/1" of PassJava-Platform, allowing attackers to access sensitive information via a crafted payload...

CVE-2025-46552 KHC-INVITATION-AUTOMATION Sensitive User Information Leakage in Invitation Automation

KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on version 1.2, a vulnerability was identified where user data, including email addresses and Discord usernames, were exposed in API responses...

CVE-2025-43862

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

CVE-2025-32795

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite...

CVE-2025-43862

CVE-2025-43862 relates to Dify, an open-source LLM app development platform. Prior to version 0.6.12, a normal (non-admin) user could access and modify APP orchestration despite UI restrictions, due to an access-control flaw. This could allow unauthorized access and changes to APPs. The issue is ...

CVE-2025-43862 Dify Allows Unauthorized Access and Modification of APP Orchestration

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

CVE-2025-43862 Dify Allows Unauthorized Access and Modification of APP Orchestration

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

PT-2025-17928 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions prior to 0.6.12 Description: The issue concerns an access control flaw in Dify, an open-source LLM app development platform. This flaw allows non-admin users to make unauthorized access and changes to APPs, despite the web UI of...

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in versions of dify prior to 0.6.12, which stems from an access control flaw that could lead to unauthorized access and modification of APP orchestration by non-administrative...

UBUNTU-CVE-2024-12244

An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1...

GitLab Enterprise Edition（EE） 安全漏洞

GitLab Enterprise Edition EE is a content management system from GitLab, Inc. in the United States. A security vulnerability exists in GitLab Enterprise Edition EE versions prior to 17.11.1, which stems from an access control issue that could cause a user to view restricted project information...

PLANET WGS-804HPT和PLANET WGS-4215-8T2S 访问控制错误漏洞

PLANET WGS-804HPT and PLANET WGS-4215-8T2S are both products of PLANET China.PLANET WGS-804HPT is an innovative industrial-grade 8-port 10/100/1000T wall-mounted managed switch.PLANET WGS-4215-8T2S is an innovative industrial-grade PLANET WGS-4215-8T2S is an innovative industrial grade 8-port...

The vulnerability of the ImportDatabase method in software for managing and monitoring deleted objects in telemetry and telemechanics systems allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ImportDatabase method in software for managing and monitoring removed objects in telemetry and telemechanics systems related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to compromise the confidentiality,...

CVE-2025-43947

Codemers KLIMS 1.6.DEV lacks a proper access control mechanism, allowing a normal KLIMS user to perform all the actions that an admin can perform, such as modifying the configuration, creating a user, uploading files, etc...

CVE-2025-46247

Missing Authorization vulnerability in codepeople Appointment Booking Calendar allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Appointment Booking Calendar: from n/a through 1.3.92...