PT-2026-93894

A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/resources/public/js/customerServe/customer.serve.js of the component Save Endpoint. This manipulation of the argument customerName causes...

CVE-2026-86644

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file websrc/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The explo...

CVE-2026-86644

star7th showdoc up to 3.9.1 contains a cross-site scripting (XSS) vulnerability in the file web_src/public/editor.md/editormd.js , triggered through the API Page Save Endpoint . The flaw allows a remote, authenticated attacker to execute arbitrary script via manipulation of the editor component. ...

CVE-2026-86644: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file websrc/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The explo...

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

EUVD-2026-63935

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780

Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 contain an authorization bypass (IDOR) in the POST /transaction/save endpoint. A user with transaction and accounting creation permissions can supply a bank_account_id or bank_card_id belonging to another company, and the value is persisted a...

CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-59233 Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

EUVD-2026-55618

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

CVE-2026-59233

CVE-2026-59233 affects Roskus Prospero Flow CRM prior to 5.2.1 in the permission management component. The permission save endpoint performs no authorization check, allowing any authenticated user to grant any role the full set of application permissions via a crafted POST request, enabling privi...

PT-2026-69482

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.2.1 Description The permission management component contains a flaw where the permission save endpoint does not perform authorization checks. This allows any authenticated user to grant any role,...

CVE-2026-67687

Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java...

CVE-2026-67687

The ICS-Park Smart Park Management System v2.0 contains an Insecure Permissions vulnerability allowing an authenticated low-privileged user to perform vertical privilege escalation. The root cause is a lack of authorization checks in the RoleController.save() method (missing @HasPermissions annot...

EUVD-2026-52487

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

CVE-2026-45419

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageServicesave, StaticResourceServersaveFilesToServe, and the /de2api/templateManage/save endpoint with attacker-controlled staticResource names and Base64 content, allowing...

CVE-2026-49867

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which...

CVE-2026-45419

DataEase contains an arbitrary file write vulnerability present before version 2.10.23. The flaw resides in template handling: the TemplateManageService#save, StaticResourceServer#saveFilesToServe methods and the /de2api/templateManage/save endpoint accept attacker-controlled staticResource names...