InnoShop 安全漏洞

InnoShop is an open source e-commerce system based on Laravel 11 by InnoShop Open Source. A security vulnerability exists in InnoShop 0.4.1 and earlier versions, which stems from the presence of insecure direct object references in multiple locations in the front-end store, which could lead to th...

PT-2025-26591 · Innoshop · Innoshop

Name of the Vulnerable Software and Affected Versions: Innoshop versions 0.4.1 and earlier Description: The issue allows for Insecure Direct Object Reference IDOR at multiple places within the frontend shop. This can be exploited by creating a customer account, allowing an attacker to disclose th...

CVE-2025-52920

Innoshop (v0.4.1 and earlier) is affected by an IDOR vulnerability in the frontend store. The issue allows disclosure of other customers’ PII and deletion of their product reviews by manipulating IDs in endpoints such as /en/account/orders/{ORDER_ID} and /en/account/reviews/{REVIEW_ID}, or by alt...

Vulnerability of the uss720_probe() function in the drivers/usb/misc/uss720.c module – The driver for supporting USB devices in Linux kernel allows a hacker to gain access to protected information.

Vulnerability of the uss720probe function in the drivers/usb/misc/uss720.c module – The Linux kernel’s USB device support driver is vulnerable to security-related errors. Exploiting this vulnerability could allow an attacker to gain access to protected information...

CVE-2025-49978

CVE-2025-49978 describes an Insecure Direct Object References (IDOR) vulnerability in the WordPress JobSearch plugin (WP Job Board) versions n/a through 2.9.0. The issue is an Authorization Bypass Through User-Controlled Key , enabling bypass of access controls for certain resources. This is supp...

CVE-2025-49995 WordPress Download Attachments plugin <= 1.3.1 - Insecure Direct Object References (IDOR) Vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Download Attachments: from n/a through 1.3.1...

The vulnerability of the Remote Access Connection Manager in Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges.

The vulnerability of the Remote Access Connection Manager in Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Microsoft .NET software platform and the Microsoft Visual Studio development tools allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft .NET software platform and the Microsoft Visual Studio development environment is related to the use of an insecure search path. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

WordPress JobSearch plugin < 3.0.6 - Insecure Direct Object References (IDOR) Vulnerability

Insecure Direct Object References IDOR Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin JobSearch versions 3.0.6...

WordPress Download Attachments plugin <= 1.3.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by haudayroi - BlueRock in WordPress Plugin Download Attachments versions = 1.3.1...

CVE-2025-26199

CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP during the login process, exposing sensitive credentials to potential interception by network-based attackers. A remote attacker with access ...

Deserialization Of Untrusted Data

goodby-csv is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to insecure deserialization due to the presence of classes that can be used in a gadget chain enabling remote code execution when deserializing untrusted data in a vulnerable application...

The vulnerability of Contour.Talk video conferencing software for macOS, related to the use of an insecure search path, allows attackers to escalate their privileges and gain unauthorized access to the system.

The vulnerability of Contour.Talk software for macOS-related video conferencing systems is related to the use of an insecure search path. Exploiting this vulnerability can allow attackers to enhance their privileges and gain unauthorized access to the system...

The vulnerability of the mbedtls_ssl_set_hostname function in Mbed TLS software allows a hacker to gain unauthorized access to protected information.

The vulnerability of the mbedtlssslsethostname function in Mbed TLS software is related to insecure resource initialization. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

CVE-2025-49214

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this...

CVE-2025-49213

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is in a different method...

CVE-2025-49217

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method...

CVE-2025-49214

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this...

CVE-2025-49213

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is in a different method...

CVE-2025-49212

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method...