1024 matches found
CVE-2026-104748
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to and including 3.10.0 . The flaw stems from the wp_ajax_nopriv_simpleform_wp_register AJAX action failing to perfor...
CVE-2026-92119
REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...
CVE-2026-92119
Apache Allura versions prior to 1.22.0 are vulnerable to a REST API Mass Assignment issue (CWE-915). The vulnerability occurs when the application binds user-provided input directly to internal objects or database models without proper filtering, potentially allowing an attacker to modify restric...
EUVD-2026-97831
REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...
CVE-2026-92119
REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...
CVE-2026-92119 Apache Allura: REST API Mass Assignment
REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...
CVE-2026-92119 Apache Allura: REST API Mass Assignment
REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...
CVE-2026-109186
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwri...
CVE-2026-109186 jshERP through 3.6 Mass Assignment via PUT /user/update
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwri...
EUVD-2026-97390
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwri...
CVE-2026-109186 jshERP through 3.6 Mass Assignment via PUT /user/update
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwri...
CVE-2026-109186
The jshERP application (versions through 3.6 ) is susceptible to a mass assignment vulnerability within the UserController update handler. This flaw allows authenticated users to overwrite protected fields, specifically tenant_id and password , by sending a crafted PUT /user/update request. Pract...
CVE-2026-109186 jshERP through 3.6 Mass Assignment via PUT /user/update
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwri...
CVE-2026-109186
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwri...
PT-2026-110575
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or...
PT-2026-110912
Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.22.0 Description Apache Allura contains a mass assignment issue within its REST API. Mass assignment occurs when an application takes user-provided input and binds it directly to an internal object or database...
CVE-2026-92119: Improperly Controlled Modification of Dynamically-Determined Object Attributes
REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...
CVE-2026-109186: Improperly Controlled Modification of Dynamically-Determined Object Attributes
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwri...
CVE-2026-108740
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.accessall= and user.emailverified=true to...
CVE-2026-108740 GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.accessall= and user.emailverified=true to...