18 matches found
EUVD-2026-102499
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService...
CVE-2026-111355
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService...
CVE-2026-111355
The zhontai Admin.Core software, through version 10.1.0 , is affected by an authorization bypass vulnerability (CWE-635). The root cause allows authenticated users to bypass department DataScope restrictions by providing record IDs that are outside of their designated scope. Specifically, attacke...
CVE-2026-111355 zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService...
CVE-2026-111355 zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService...
CVE-2026-111355
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService...
CVE-2026-111355 zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService...
CVE-2026-111355: Authorization Bypass Through User-Controlled Key
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService...
PT-2026-115299
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService...
zhontai Admin.Core Authorization Vulnerability
The zhontai Admin Core versions 10.1.0 and earlier have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism. Attackers can provide record IDs that exceed the allowed range, bypassing DataScope’s restrictions. Attackers who possess user or...
EUVD-2025-5285
Malicious code in bioql PyPI...
CVE-2024-50689
SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the orgService API model...
CVE-2024-50689
SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the orgService API model...
CVE-2024-50689
SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the orgService API model...
CVE-2024-50689
SunGrow iSolarCloud , an Android application for new energy power plant management, is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists within the orgService API model , potentially allowing unauthorized access or actions. This vulnerability affects versions released pri...
PT-2025-8745
Name of the Vulnerable Software and Affected Versions SunGrow iSolarCloud versions prior to the October 31, 2024 remediation Description The issue is related to insecure direct object references IDOR via the "orgService API model". Recommendations For versions prior to the October 31, 2024...
CVE-2024-50689: Authorization Bypass Through User-Controlled Key
SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the orgService API model...