EUVD-2026-72533

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

CVE-2026-86437

Lara Dashboard before 1.3.2 incorrectly authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing any non-Superadmin administrator to upload and extract arbitrary zip archives over the live application source tree. An attacker with this per...

CVE-2026-86437 Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

CVE-2026-86437 Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

PT-2026-86920

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update

Impact The BulkAssetsController::update method accepts companyid directly from user input without calling Company::getIdForCurrentUser, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking...

CVE-2026-56396

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser and updateUserRights endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edituser permission can set issuperadmin flag or grant arbitrary rights to escalate to SuperAdm...

EUVD-2020-2694

Malware in sbrugna...

CVE-2020-10239

An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of comfields allows access for non-superadmin users...

CVE-2020-10239

An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of comfields allows access for non-superadmin users...

CVE-2020-10239: Incorrect Authorization

An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of comfields allows access for non-superadmin users...

[20200305] - Core - Incorrect Access Control in com_fields SQL field

Incorrect Access Control in the SQL fieldtype of comfields allows access for non-superadmin users...