EUVD-2026-114063

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/deptI...

CVE-2026-119647

The software RuoYi-Vue-Plus (versions through 6.0.0) is vulnerable to an authorization bypass in the SysUserServiceImpl.selectUserListByDept component. This flaw allows authenticated users with a department-restricted role (possessing system:user:list permissions) to bypass data scope restriction...

Vehicle-Service-Management-System-User-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46073 Exploit Title: Vehicle Service Management System - 'User List' Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIUM References: https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss...

snmpwn

SNMPwn is an SNMPv3 user enumerator and attack tool. It is a legitimate security tool designed to be used by security professionals and penetration testers against hosts you have permission to test. It takes advantage of the fact that SNMPv3 systems will respond with "Unknown user name" when an...

CVE-2021-46073

CVE-2021-46073 Exploit Title: Vehicle Service Management System - 'User List' Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIUM References: https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss...

CVE-2026-114485

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...

EUVD-2026-108217

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...

CVE-2026-114485

The Devolutions Server version 2026.3.10.0 and earlier contains a vulnerability involving the insufficient protection of sensitive information within the user list endpoint . An authenticated attacker possessing delegated user view permissions can exploit this flaw to obtain the MFA secrets of al...

CVE-2026-114485

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...

PT-2026-121410

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...

Devolutions Server information disclosure vulnerability

Devolutions Server versions 2026.3.10.0 and earlier contain an information disclosure vulnerability. This vulnerability stems from insufficient protection of sensitive information on the user list endpoint. Attackers who are authenticated and have delegated permissions to view users can obtain th...

CVE-2026-68482

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade ...

CVE-2026-68482

Apache Answer versions through 2.0.2 are vulnerable to a missing authorization (CWE-862) flaw in the question invite user lookup. Due to missing visibility authorization checks, an unauthenticated or unauthorized user can retrieve the invited-user list for questions that are not public. To mitiga...

CVE-2026-68482 Apache Answer: Improper Authorization in Question Invite User Lookup

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade ...

EUVD-2026-104157

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade ...

CVE-2026-68482

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade ...

PT-2026-117314

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade ...

CVE-2026-68482: Missing Authorization

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade ...

CVE-2026-111669

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery ...

CVE-2026-111669 ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery ...