1716 matches found
CVE-2025-10696 OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party the target user, who can then view the...
CVE-2025-10696 OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party the target user, who can then view the...
CVE-2025-10692
CVE-2025-10692 describes an SQL injection in OpenSupports 4.11.0 via POST /api/staff/get-new-tickets, where the user-supplied departmentId is concatenated into the SQL WHERE clause without parameter binding. An authenticated staff user (level ≥ 1) can alter filtering to access tickets outside the...
EUVD-2025-32372
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
CVE-2025-10692 OpenSupports 4.11.0 — SQL Injection
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
EUVD-2022-35527
Malicious code in bioql PyPI...
EUVD-2024-17077
Malicious code in bioql PyPI...
EUVD-2025-27401
Malicious code in bioql PyPI...
EUVD-2024-45912
Malicious code in bioql PyPI...
EUVD-2024-27644
Malicious code in bioql PyPI...
EUVD-2022-48056
Malicious code in bioql PyPI...
EUVD-2025-2938
Malicious code in bioql PyPI...
EUVD-2023-28052
Malicious code in bioql PyPI...
EUVD-2024-35411
Malicious code in bioql PyPI...
EUVD-2024-51686
Malicious code in bioql PyPI...
EUVD-2022-50202
Malicious code in bioql PyPI...
EUVD-2025-28423
Malicious code in bioql PyPI...
EUVD-2024-37073
Malicious code in bioql PyPI...