590 matches found
GHSA-X45J-JQ9Q-GF3Q Moodle makes some user data available before completing second factor with MFA enabled
A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor authentication 2FA...
CVE-2025-32044 Moodle: unauthenticated rest api user data exposure
A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exceptionignoreargs = 1 in the...
CVE-2025-32044 Moodle: unauthenticated rest api user data exposure
A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exceptionignoreargs = 1 in the...
CVE-2025-3625
Summary of CVE-2025-3625 ( Moodle ) : The connected BIT-MOODLE-2025-3625 entry reports a vulnerability in Moodle described as an IDOR (in the MFA email factor revoke action) that can allow a user to disclose other users’ names and potentially gain access to sensitive information, while also enabl...
PT-2025-17920
Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A flaw was found in the messaging web service of Moodle, where insufficient capability checks allowed users to view other users' names and online statuses. Recommendations At the moment, there...
CVE-2025-32789
EspoCRM (open-source CRM) prior to version 9.0.7 is affected by a vulnerability in the user password hashing disclosure feature. The issue allows an attacker to infer other users’ password hashes by sorting the user list by the password hash, potentially enabling password changes if the attacker ...
CVE-2025-32789 EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function
EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the user table, based on the results of t...
PT-2025-16531
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description Unauthenticated attackers can retrieve the full list of users associated with arbitrary accounts. Recommendations At the moment, there is no information about a newer version that contains a f...
Moodle 4.4.x < 4.4.4 Multiple Vulnerabilities
According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.14, 4.2.x prior to 4.2.11, 4.3.x prior to 4.3.8, or 4.4.x prior to 4.4.4. It is, therefore, affected by multiple vulnerabilities. - An IDOR when fetching report schedules. - Some users can...
Moodle < 4.1.14 Multiple Vulnerabilities
According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.14, 4.2.x prior to 4.2.11, 4.3.x prior to 4.3.8, or 4.4.x prior to 4.4.4. It is, therefore, affected by multiple vulnerabilities. - An IDOR when fetching report schedules. - Some users can...
PT-2025-14461
Name of the Vulnerable Software and Affected Versions Zabbix affected versions not specified Description The issue concerns the Zabbix API, specifically the "user.get" endpoint, which returns all users that share a common group with the calling user. This includes sensitive information such as...
CVE-2024-8613 Improper Access Control in gaizhenbiao/chuanhuchatgpt
A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240802 allows attackers to access, copy, and delete other users' chat histories. This issue arises due to improper handling of session data and lack of access control mechanisms, enabling attackers to view and manipulate chat histories of...
CVE-2024-11300 Improper Access Control in lunary-ai/lunary
In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can access prompt data of another user. This issue affects version 1.6.2 and the main branch. The vulnerability allows unauthorized users to view sensitive prompt data by accessing specific URLs...
CVE-2024-12869 Improper Authentication in infiniflow/ragflow
In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed...
CVE-2025-2202
Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sensitive information about other users such as id, name, login and email...
CVE-2025-2201 Broken access control vulnerability in the Innovación y Cualificación IcProgreso plugin
Broken access control vulnerability in the IcProgress Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain sensitive information about other users such as public IP addresses, messages with other users and more...
vBulletin 5.0.0 Beta 28 SQL Injection
vBulletin version 5.0.0 Beta 28 proof of concept remote SQL injection exploit that leverages a vulnerability discovered in 2013. ============================================================================================================================================= | Title : vBulletin 5.0.0...
Apple macOS Sequoia Information Disclosure Vulnerability
Apple macOS is a specialized operating system developed by Apple for Mac computers. A security vulnerability exists in Apple macOS Sequoia, which stems from an improvement in the editing of sensitive information, and can be exploited by an attacker to access sensitive user data...
CVE-2025-27101 Broken Access Control in Opal filesystem's copy functionality exposes all user data
Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of t...