CVE-2021-46075

CVE-2021-46075 Exploit Title: 차량 서비스 관리 시스템 - '다중' 권한 상승으로 인한 CRUD 작업 Exploit Author: SANU P.L CVE: CVE-2021-46075 CVSS: 7.2 높음 참조: https://www.plsanu.com/vehicle-service-management-system-multiple-privilege-escalation-leads-to-crud-operations https://nvd.nist.gov/vuln/detail/CVE-2021-46075...

Vehicle-Service-Management-System-Multiple-Privilege-Escalation-Leads-to-CRUD-Operations

CVE-2021-46075 Exploit-Titel: Vehicle Service Management System - 'Multiple' Privilege Escalation führt zu CRUD-Operationen Exploit-Autor: SANU P.L CVE: CVE-2021-46075 CVSS: 7.2 HIGH Referenzen:...

CVE-2026-54624 django CMS: Structure endpoint bypasses page-view permission

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

CVE-2026-54624 django CMS: Structure endpoint bypasses page-view permission

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

CVE-2026-54624

In django CMS before 5.0.8, the structure endpoint in cms/views.py renders structure.html without calling user_can_view_page(), unlike edit/preview endpoints. A low-privileged staff user can read restricted pages' plugin short descriptions (link names, URLs, snippets) when CMS_PERMISSION=True and...

CVE-2026-53943

The CVE-2026-53943 entry describes a Ghost CMS vulnerability where, on sites behind a shared caching layer, an unauthenticated user can send an x-ghost-preview header that poisons cached responses, altering rendered frontend output. In affected configurations, this cached, request-specific previe...

CVE-2024-13146

The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack...

CVE-2024-13146 Booknetic < 4.1.5 - Staff Creation via CSRF

The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack...

CVE-2024-13146

The CVE-2024-13146 entry concerns the WordPress Booknetic plugin (pre-4.1.5) lacking CSRF protection when creating Staff accounts, enabling a logged-in attacker to add arbitrary Staff members via CSRF. Affected: Booknetic WordPress plugin versions prior to 4.1.5. Root cause: missing CSRF check on...

MAL-2024-3051 Malicious code in staff-account (npm)

False positive caused by problematic ingestion. --- -= Per source details. Do not edit below this line.=-...

CVE-2024-26492

An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request using the id, email, password, and cpass parameters...

PT-2024-21406 · Unknown · Online Diagnostic Lab Management System

Name of the Vulnerable Software and Affected Versions: Online Diagnostic Lab Management System version 1.0 Description: The issue allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request. The attacker can exploit this by using the id, email, password, and cpas...

Malicious code in @zettle-bo/staff-account (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6890c2d23d73e43eaf40b3d6435083b993f77894876b67b4a2ea41c9a223f3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-46075

A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access the admin resources and perform CRUD Operations...

Privilege escalation

A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access the admin resources and perform CRUD Operations...

Shopify: Undocumented `fileCopy` GraphQL API

Impact A malicious staff account with no permissions can copy other store file assets to current store, which they have no access to. Details So the story as follow A malicious staff member jackmccracken on storeA.myshopify.com wants to upload a file on the store but could not, due to permissions...

Shopify: increased privileges on staff account

staff on partners without a store management permit can have access to the collaboration shop steps for reproduction 1. Invite staff to partners without store management permission 2. accept the invitation and the staff has become a member of the partner 3. On the staff account, try to access the...

Shopify: Ability to link a Google account to another staff account/store owner that isn't linked yet

The https://pos-channel.shopifycloud.com/graphql-proxy/admin endpoint allows us to update a staff email address that is having a Shopify ID. Taking that into consideration, if a store is setup to use Google Apps as login service and if a staff/store owner hasn't yet linked his account to a Google...

Shopify: Order notifications being sent for a deactivated staff account

Hi, Steps to reproduce : - - Have a staff account with settings permission - The staff account can go to notifications & add himself so as to get new order notifications - Now,deactivate the staff account via the admin. - Create a new order,you shall see that the staff still receives the order...

Shopify: race condition in adding team members

The researcher reported a race condition when adding new staff members that would allow bypassing the staff account limit for all plans. We fixed this issue by adding an exclusive lock around the account creation process. Note: Shopify no longer accepts reports regarding race conditions bypassing...