CVE-2026-110213 ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to...

CVE-2026-110127 waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE...

CVE-2026-110125 waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm,...

CVE-2026-110125

Waynboot-mall through version 2.0.0 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. Authenticated members can access and modify the orders of other members by supplying specific order identifiers. By enumerating sequential order IDs or serial numbers, an attacker can i...

CVE-2026-110125 waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm,...

CVE-2026-110114 oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints

FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared...

CVE-2024-34320

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...

CVE-2024-34320

The ProPhoenix Law RMS software, specifically version v2022.2403.3.101 , is affected by an incorrect access control issue. This vulnerability exists within sensitive API endpoints , potentially allowing unauthorized access to restricted data or functions. The CVSS 3.1 score for this vulnerability...

CVE-2026-110213: Authorization Bypass Through User-Controlled Key

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to...

CVE-2024-34320

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...

CVE-2024-34320

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...

CVE-2026-110125: Authorization Bypass Through User-Controlled Key

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm,...

CVE-2024-34320: Improper Access Control

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...

CVE-2026-109643

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned...

CVE-2026-109668 Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoint...

CVE-2026-109668 Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoint...

CVE-2026-109655

Frappe ERPNext versions before 15.115.0 and 16.x before 16.26.0 are vulnerable to a missing authorization flaw (CWE-862) in certain endpoints. The root cause is a failure to enforce proper role-based authorization checks , which allows authenticated low-privileged users to send requests that modi...

CVE-2026-109654

Frappe ERPNext versions before 15.119.0 and 16.x before 16.31.0 are susceptible to a missing authorization vulnerability. Certain endpoints fail to verify if a caller has permission to read a specific document before initiating a transactional email. Consequently, authenticated attackers can trig...

CVE-2026-109643 Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned...

CVE-2026-109639 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests

Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to...