Access Control Bypass

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Access Control Bypass in the files method of AssetModelPolicy. An attacker can upload and delete file attachments on Asset Model records without proper authorization by...

CVE-2026-86774 Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission...

CVE-2026-86774: Improper Access Control

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission...

CVE-2024-51499 MarkUs Arbitrary File Write leading up to remote code execution (student accounts)

MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability accessible via the updatefiles method of the SubmissionsController allows authenticated users e.g. students to write arbitrary files to any location...

PT-2024-34663

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.4.8 Description MarkUs is a web application for the submission and grading of student assignments. An arbitrary file write vulnerability accessible via the update files method of the SubmissionsController allows...

CVE-2006-3925

Stack-based buffer overflow in ITIRecorder.MicRecorder ActiveX control in iarecord.dll in InterActual Player before 2.6 allows remote attackers to execute arbitrary code via a long argument to the Files method. NOTE: the provenance of this information is unknown; the details are obtained from thi...

CVE-2006-3925: Undefined Security Weakness

Stack-based buffer overflow in ITIRecorder.MicRecorder ActiveX control in iarecord.dll in InterActual Player before 2.6 allows remote attackers to execute arbitrary code via a long argument to the Files method. NOTE: the provenance of this information is unknown; the details are obtained from thi...