CVE-2025-43732: Authorization Bypass Through User-Controlled Key

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference IDOR in the...

CVE-2025-54396

Netwrix Directory Manager formerly Imanami GroupID 11.0.0.0 before 11.1.25162.02 allows SQL Injection. Authenticated users can exploit this...

CVE-2025-54397: Improper Access Control

Netwrix Directory Manager formerly Imanami GroupID 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into Sent Data to authenticated users...

CVE-2025-48747

Netwrix Directory Manager formerly Imanami GroupID before and including v.11.0.0.0 and after v.11.1.25134.03 has Incorrect Permission Assignment for a Critical Resource...

CVE-2025-48746: Improper Authentication

Netwrix Directory Manager formerly Imanami GroupID v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authentication for a Critical Function...

CVE-2022-27431

Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php...

CVE-2020-21809

SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the 1 listid parameter in detail.php and the 2 groupprice or groupid parameters in searchresult.php...

CVE-2025-22930

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php...

CVE-2025-22930

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php...

CVE-2025-22930: Improper Neutralization of Special Elements used in an SQL Command

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php...

CVE-2025-22930

OS4ED openSIS versions v7.0 through v9.1 are affected by a SQL injection vulnerability (CWE-89). The flaw exists in the groupid parameter located at the /messaging/Group.php endpoint. An attacker could exploit this to perform unauthorized database operations. To mitigate this risk, it is recommen...

CVE-2025-22930

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php...

CVE-2025-22930

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php...

Open Solutions For Education openSIS 安全漏洞

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions For Education openSIS versions v7.0 through v9.1, which stems from a SQL injection issue with the groupid paramete...

PT-2025-14639 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 7.0 through 9.1 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the groupid parameter at the "/messaging/Group.php" endpoint. Recommendations: For OS4ED openSI...

CVE-2024-11167

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user...

LibreChat 访问控制错误漏洞

LibreChat is an enhanced ChatGPT clone. An Access Control Error vulnerability exists in versions of LibreChat prior to 0.7.6, which stems from the groupid parameter not verifying that the prompt ID provided belongs to the current user, and can be exploited by an attacker to cause the deletion of...

CVE-2024-11167: Authorization Bypass Through User-Controlled Key

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user...

CVE-2025-2030: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Seeyon Zhiyuan Interconnect FE Collaborative Office Platform up to 20250224. It has been rated as critical. Affected by this issue is some unknown functionality of the file /security/addUser.jsp. The manipulation of the argument groupId leads to sql injection. The...

BeiJing Seeyon Internet FE Collaborative Office Platform 安全漏洞

BeiJing Seeyon Internet FE Collaborative Office Platform is a collaborative office platform software from BeiJing Seeyon Internet BeiJing Seeyon Internet in Beijing, China, which is used for collaborative office work and information sharing within an organization. A security vulnerability exists ...