CVE-2024-9150

Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a low privileges account in order to abuse this functionality and execute malicious code, load DLL libraries and executing OS commands on a...

CVE-2024-9150 Code Injection in Wyn Enterprise

Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a low privileges account in order to abuse this functionality and execute malicious code, load DLL libraries and executing OS commands on a...

PT-2025-7455 · Unknown · Wyn Enterprise

Name of the Vulnerable Software and Affected Versions: Wyn Enterprise versions prior to 8.0.00204.0 Description: The report generation functionality in Wyn Enterprise allows for code inclusion but does not sufficiently limit what code might be included. An attacker can use a low-privileges accoun...

PT-2025-7644 · Leantime · Leantime

Name of the Vulnerable Software and Affected Versions: Leantime affected versions not specified Description: The issue allows stored cross-site scripting XSS in the API key name while generating the API key. Any low-privileged user, such as a manager or editor, can create an API key with an XSS...

CVE-2025-21106

Dell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Local attacker could potentially exploit this vulnerability, leading to impacting only non-sensitive resources in the system...

CVE-2025-21106

Dell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Local attacker could potentially exploit this vulnerability, leading to impacting only non-sensitive resources in the system...

mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024)

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service DoS...

mysql: Parser unspecified vulnerability (CPU Jan 2025)

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service DoS...

mysql: X Plugin unspecified vulnerability (CPU Oct 2024)

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service DoS...

mysql: Optimizer unspecified vulnerability (CPU Jan 2025)

A flaw was found in the MySQL Server product of Oracle MySQL. This vulnerability allows a remote attacker to cause a denial of service DoS...

mysql: MySQL Server: Unauthorized Data Modification and Read Access Vulnerability

A flaw was found in Oracle MySQL Server Security: Privileges component. A low-privileged remote attacker with network access can gain unauthorized read and write access to MySQL Server data...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

CVE-2024-56882

Sage DPW before 202412000 is vulnerable to Cross Site Scripting XSS. Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with...

Sage DPW 安全漏洞

Sage DPW is an HR system from Sage UK. A security vulnerability exists in versions prior to Sage DPW 202412000, which stems from a lack of server-side access control and can lead to overstepping by a low-privileged user...

CVE-2025-0592

The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device...

Vulnerability in SICK Lector8xx and SICK InspectorP8xx

SICK has found two vulnerabilities that affect the SICK Lector8xx and SICK InspectorP8xx. The vulnerabilities may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file or executing low-level functions. SICK is currently not aware of any public...

CVE-2024-26016

A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be...

CVE-2025-26371

A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to add users to groups via crafted HTTP requests...

PT-2025-7165 · Q Free · Q-Free Maxtime

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: A missing authorization issue in maxprofile/users/routes.lua allows an authenticated, low-privileged attacker to modify user data via crafted HTTP requests. Recommendations: For versions...

PT-2025-7160 · Q Free · Q-Free Maxtime

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to missing authorization, allowing an authenticated attacker with low privileges to add users to groups via crafted HTTP requests. This is due to a problem in the...