Improper Access Control

mad-proxy is vulnerable to Improper Access Control. The vulnerability is due to flaws in HTTP/HTTPS traffic interception logic, allowing attackers to bypass security policies and evade traffic inspection, potentially exposing sensitive data...

Improper Access Control

apacheairflow is vulnerable to improper access control. The vulnerability is due to insufficient authorization checks in the bulk create API with the overwrite action, which allows an attacker with only CREATE privileges to update existing Pools, Connections, and Variables without having UPDATE...

Improper Access Control

Doris MCP Server is vulnerable to Improper Access Control. The vulnerability is due to an attacker with a valid read-only account being able to bypass Doris MCP Server’s read-only mode, where they can perform unauthorized modifications, and attackers with read-only access may perform unauthorized...

Improper Access Control

mcp MCP Python SDK is vulnerable to Improper Access Control. The vulnerability is due to DNS rebinding protection not being enabled by default for HTTP-based servers, allowing a malicious website to bypass same-origin policy and send requests to a local MCP server running without authentication,...

Improper Access Control

mineadmin/mineadmin is vulnerable to Improper Access Control. The vulnerability is due to insecure permission settings in the scheduled tasks feature, which allows an attacker to execute arbitrary commands and potentially achieve full account takeover...

Improper Access Control

mantisbt/mantisbt is vulnerable to improper access control. The vulnerability is due to insufficient access-level checks, which allows an attacker to exploit the Copy From functionality to retrieve column configurations from private projects without authorization...

Improper Access Control

getgrav/grav is vulnerable to improper access control. The vulnerability is due to insufficient restriction on the "Frontmatter" form, which allows a low-privileged user to read sensitive server files and exploit them to compromise user accounts...

Improper Access Control

dnn.platform is vulnerable to improper access control. The vulnerability is due to the default HTML editing configuration allowing unauthenticated file uploads, which allows an attacker to upload arbitrary files and potentially leverage them for further compromise...

Improper Access Control

Liferay Portal is vulnerable to improper access control. The vulnerability is due to APIs not restricting access before a user verifies their email address, which allows a remote attacker to access and modify content through the API without proper verification...

Improper Access Control

com.blazemeter.plugins, BlazeMeterJenkinsPlugin is vulnerable to Improper Access Control. The vulnerability is due to insufficient permission checks in the Jenkins UI, which allows an attacker to view sensitive resource identifiers such as credential IDs, workspaces, and project IDs without prope...

CVE-2025-67740

In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata...

WordPress Animation Addons for Elementor plugin SQL Injection Vulnerability

WordPress Animation Addons for Elementor plugin is an Elementor page builder extension plugin for the WordPress platform, focused on adding rich animation effects to websites. The WordPress Animation Addons for Elementor plugin suffers from a SQL injection vulnerability that stems from improper...

Plesk 安全漏洞

Plesk is a web hosting control panel from the Swiss company Plesk. A security vulnerability exists in Plesk version 18.0 that stems from improper access control...

CVE-2025-64669

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally...

CVE-2025-64669

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally...

EUVD-2025-202725

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally...

CVE-2025-67740

In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata...

CVE-2025-67740

JetBrains TeamCity CVE-2025-67740 affects TeamCity before 2025.11.0, where improper access control could expose GitHub App token metadata. The connected Nessus entry notes multiple vulnerabilities in versions prior to 2025.11.0 (e.g., CVEs 67741, 67765, 68166, etc.). Remediation: upgrade to TeamC...

CVE-2025-61811

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could leverage this vulnerability to bypass security measures and execute...

JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides features such as continuous unit testing, code quality analysis and build issue analysis reports. A security vulnerability exists in JetBrains TeamCity...