CVE-2026-59240

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

CVE-2026-59240

The CVE-2026-59240 vulnerability is an IDOR in Prospero Flow CRM. Affected code path: DeleteNotificationController::delete() at GET /notification/delete/{id}. It allows any authenticated user to delete notifications belonging to any user because the target record is fetched with Notification::fin...

PT-2026-65305

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

jeesite 安全漏洞

Zhuo source software Jeesite is China's Zhuo source software company of a set of open source Java EE enterprise-class rapid development platform . The platform includes system permissions components, data permissions components, data dictionary components, core tools components, view manipulation...

Cross-Site Request Forgery (CSRF) in pimcore/pimcore

✍️ Description Your application have not any CSRF protection and also You set the SameSite attribute to Lax, this means if you want to alter some data with GET HTTP requests, then your site should be vulnerable to CSRF attacks with no doubt. First you run this Html payload and then you should see...