3209 matches found
CVE-2026-24900
MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses//assignments//submissions/htmlcontent accepted a selectfileid parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correct...
CVE-2026-25231 FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control
FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this directory can be accessed directly by any user who knows or...
FUXA 访问控制错误漏洞
FUXA is a web-based process visualization software developed by frangoteam. Versions of FUXA 1.2.9 and earlier contained a security vulnerability related to access control. This vulnerability was caused by path traversal attacks, which could allow unverified remote attackers to write arbitrary...
Adminer 访问控制错误漏洞
Adminer is an open-source WordPress plugin developed by Adminer. It allows WordPress administrators to perform database management tasks more efficiently. Versions of Adminer prior to 2.2.1 contained a security vulnerability related to access control. This vulnerability stemmed from the fact that...
Tenda AC21 访问控制错误漏洞
Tenda AC21 is a wireless router produced by the Chinese company Tenda. The Tenda AC21 version 16.03.08.16 has a vulnerability related to access control. This vulnerability stems from incorrect handling of the /cgi-bin/DownloadFlash file, which may lead to information leakage...
CVE-2026-2075 yeqifu warehouse Role-Permission Binding RoleController.java saveRolePermission access control
A security flaw has been discovered in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected is the function saveRolePermission of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\RoleController.java of the component Role-Permission Binding Handler. The...
ACE SECURITY WiP-90113 访问控制错误漏洞
ACE SECURITY WiP-90113 is a camera product developed by the Japanese company ACE SECURITY. ACE SECURITY WiP-90113 has a vulnerability related to access control. This vulnerability arises from the unprotected configuration of backup endpoints, which may allow unverified attackers to retrieve...
CVE-2026-24920
Permission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2026-24920
Permission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2026-24923
Permission control vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-2009
A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/phpaction/createUser.php. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been...
CVE-2026-2009 SourceCodester Gas Agency Management System createUser.php access control
A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/phpaction/createUser.php. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been...
CVE-2026-1898
A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able...
D-Link DIR-605L 访问控制错误漏洞
The D-Link DIR-605L is a wireless router produced by D-Link Corporation. The D-Link DIR-605L versions 2.06B01/2.13B01 and DIR-619L versions 2.06B01/2.13B01 have a vulnerability related to access control. This vulnerability stems from incorrect operations on the Wifi Setting Handler component, whi...
D-Link DIR-605L和D-Link DIR-619L 访问控制错误漏洞
The D-Link DIR-605L and D-Link DIR-619L are wireless routers produced by the Chinese company D-Link. The D-Link DIR-605L versions 2.06B01/2.13B01 and DIR-619L versions 2.06B01/2.13B01 have a vulnerability related to access control. This vulnerability stems from incorrect operations on the...
Huawei HarmonyOS 安全漏洞
Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege control vulnerability exists in the Huawei HarmonyOS HDC module, which can be exploited by an attacker to compromise confidentiality...
CVE-2025-70963
Gophish =0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context...
DeepAudit 安全漏洞
DeepAudit is an automated vulnerability auditing tool developed by lintsinghua’s individual developers. Versions of DeepAudit 3.0.4 and earlier contain security vulnerabilities. These vulnerabilities stem from improper access control on the /api/v1/users endpoint, which may allow any authenticate...
CVE-2025-70963
Summary: CVE-2025-70963 affects Gophish prior to 0.12.1. The admin dashboard exposes each user’s long‑lived API key directly in the rendered HTML/JavaScript on login, enabling access to permanent API credentials from browser scripts. This is an Incorrect Access Control vulnerability with HIGH imp...