GHSA-57Q6-FVP4-PQMM Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints

Summary Open WebUI allows admins to restrict which API endpoints an API key can access. When an API key is restricted from /api/v1/messages, requests using the Authorization: Bearer sk-... header are correctly blocked with 403. However, the same key sent via the x-api-key header bypasses the...

PT-2026-41174

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description An issue exists where administrators' restrictions on API endpoint access can be bypassed. While requests using the Authorization: Bearer header are correctly blocked when restricted from the...

EUVD-2025-209027

IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to improper restriction of channel communication to intended endpoints...

PT-2026-28115

IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to improper restriction of channel communication to intended endpoints...

Exploit for Code Injection in Xwiki

📜 Description A critical RCE vulnerability exists in...

PT-2025-28184 · Unknown · Employee Record Management System

Name of the Vulnerable Software and Affected Versions: Employee Record Management System in PHP and MySQL version 1 Description: A SQL injection issue was found in the system via the "loginerms.php" endpoint. This allows for potential exploitation by injecting malicious SQL code. Recommendations:...

PT-2025-27798 · N8N · N8N

Name of the Vulnerable Software and Affected Versions: n8n versions prior to 1.99.0 Description: The issue is a Denial of Service vulnerability in the "/rest/binary-data" endpoint when processing empty filesystem URIs filesystem:// or filesystem-v2://. This allows authenticated attackers to cause...

PT-2025-23642 · Audiocodes · Audiocodes Mediapack Mp-11X

Name of the Vulnerable Software and Affected Versions: Audiocodes Mediapack MP-11x versions 6.60A.369.002 and earlier Description: The issue allows an unauthenticated remote user to execute unauthorized code by sending a crafted POST request. This can result in the execution of unauthorized code...

PT-2025-18306 · Sourcecodester · Sourcecodester Simple Parking Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Barangay Management System version 1.0 Description: The issue is a SQL injection vulnerability located in the "/barangay management/admin/?page=view clearance" API endpoint. This vulnerability can be exploited to inject...

PT-2025-3457 · Unknown · Code-Projects Online Car Rental System

Name of the Vulnerable Software and Affected Versions: Code-Projects Online Car Rental System version 1.0 Description: The issue is related to Cross Site Scripting XSS via the vehicalorcview parameter in the "/admin/edit-vehicle.php" API endpoint. This flaw can be exploited by attackers to inject...

The vulnerability of the PC Client component of the embedded applications and document management tools of Ricoh Streamline NX allows a perpetrator to execute arbitrary code.

The vulnerability of the PC Client component of the embedded applications and Ricoh Streamline NX document management tools is related to insufficient restrictions on communication channels for specified endpoints. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

PT-2024-2496 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 15.03.06.44 Description: A critical issue is present in the Tenda AC7 router's software, related to the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the mac argument leads to os command...

PT-2023-31468 · Sourcecodester · Sourcecodester Customer Support System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Customer Support System version 1.0 Description: The issue concerns multiple SQL injection vulnerabilities in the /customer support/ajax.php?action=save department endpoint via the id or name variables. This allows for potentia...

PT-2023-30282 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus version 4.2.0 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in the "/common/log/list" API endpoint. Recommendations: For Novel-Plus version 4.2.0,...

PT-2022-26816 · Unknown · Human Resource Management System

Name of the Vulnerable Software and Affected Versions: Human Resource Management System version 1.0 Description: A SQL injection issue was found in the Human Resource Management System. The vulnerability can be exploited via the password parameter at the "/hrm/controller/login.php" API endpoint...