298460 matches found
CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...
EUVD-2026-85338
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...
CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...
CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...
CVE-2026-86679
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...
CVE-2026-86683
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...
CVE-2026-86678
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions...
CVE-2026-62998
The REDAXO PHP-based content management system is vulnerable to an unauthorized ORDER BY identifier injection in versions prior to 5.21.2 . The root cause is located in rex_list::getSortColumn() within redaxo/src/core/lib/list.php, which fails to verify if a requested column was registered via se...
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
Summary The mediapool sync page sync.php renders filenames from the /media filesystem directory directly into HTML without applying rexescape i.e., htmlspecialchars. Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any...
GHSA-RR49-F9G6-C9R5 plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
Impact The Classic portlet plone.app.portlets.portlets.classic used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet...
CVE-2026-86678
ZohoCorp ManageEngine Applications Manager versions 182000 and below are vulnerable to a broken authentication flaw. This vulnerability allows a low-privileged user to obtain an administrator’s API key , which can then be leveraged to perform administrator-level actions . Exploitation details and...
CVE-2026-86678 Broken Authentication vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions...
CVE-2026-86677
ZohoCorp ManageEngine Applications Manager (versions 182000 and below) is vulnerable to a Broken Authentication issue caused by the improper neutralization of special elements in an SQL command . This flaw allows a low-privileged user to execute unauthorized SQL commands, which could lead to admi...
EUVD-2026-85295
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...
EUVD-2026-85293
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...
CVE-2026-86679
ZohoCorp ManageEngine Applications Manager (versions 182000 and below ) is susceptible to a permissions validation issue . This vulnerability allows a low-privileged user to delete service monitors that are outside of their assigned scope. The documents do not provide specific details regarding t...
CVE-2026-86679 Broken Access Control vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...
CVE-2026-86679 Broken Access Control vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...