14 matches found
CVE-2026-111616
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to...
CVE-2026-111616 Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to...
CVE-2026-111616
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to...
EUVD-2026-103038
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to...
CVE-2026-111616 Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to...
CVE-2026-111616
The Oqtane Framework through version 10.2.6 contains an authorization bypass vulnerability within the SettingController . This flaw allows an attacker with the Administrators role on one site to access another co-tenant site's private settings by requesting a different site's entityId through the...
PT-2026-116015
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to...
CVE-2026-111616: Authorization Bypass Through User-Controlled Key
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to...
Oqtane Framework Authorization Vulnerability
The Oqtane Framework versions 10.2.6 and earlier have an authorization vulnerability. This vulnerability stems from a permission bypass issue in the SettingController. Attackers can use their alias to request entityId from other sites, thereby reading the stored SMTPPassword and SMTPClientSecret...
EUVD-2022-44635
Malicious code in bioql PyPI...
CVE-2025-43924
Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController for /fp/admin/settings/loginpage and the rootserviceurl parameter in FriendsController for /fp/admin/settings/friends, entered by an admin, allow stored XSS...
CVE-2025-43924: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController for /fp/admin/settings/loginpage and the rootserviceurl parameter in FriendsController for /fp/admin/settings/friends, entered by an admin, allow stored XSS...
CVE-2022-41442
PicUploader v2.6.3 was discovered to contain cross-site scripting XSS vulnerability via the setStorageParams function in SettingController.php...
Wolf CMS 0.6.0b - Multiple Vulnerabilities
Wolf CMS 0.6.0b - Multiple Vulnerabilities Vulnerability ID: HTB22681 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinwolfcms.html Product: Wolf CMS Vendor: Wolf CMS team http://www.wolfcms.org/ Vulnerable Version: 0.6.0b and probably prior versions Vendor Notification: 09 November 2010...