55 matches found
CVE-2026-50550: Incorrect Authorization
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset. The endpoint authorizes update access but does not enforce canEditAuthFiel...
CVE-2025-10762
A vulnerability was found in kuaifan DooTask up to 1.2.49. Affected by this vulnerability is an unknown functionality of the file app/Http/Controllers/Api/UsersController.php. The manipulation of the argument keysdepartment results in sql injection. The attack can be executed remotely. The exploi...
CVE-2025-10762: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in kuaifan DooTask up to 1.2.49. Affected by this vulnerability is an unknown functionality of the file app/Http/Controllers/Api/UsersController.php. The manipulation of the argument keysdepartment results in sql injection. The attack can be executed remotely. The exploi...
CVE-2024-48322
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability...
CVE-2024-48322
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability...
CVE-2024-48322
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability...
CVE-2024-48322: Time-of-check Time-of-use (TOCTOU) Race Condition
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability...
CVE-2024-48322
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability...
CVE-2024-48322
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability...
CVE-2022-42724
app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names this is information that only the site admin should have...
CVE-2022-42724
app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names this is information that only the site admin should have...
MISP 信息泄露漏洞
MISP is an open source software solution. It is used to collect, store, distribute, and share network security metrics, and has features such as threat network security event analysis and malware analysis. information leakage vulnerability exists in versions of MISP prior to 2.4.164, which stems...
CVE-2022-42724: Incorrect Authorization
app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names this is information that only the site admin should have...
CVE-2022-42724
app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names this is information that only the site admin should have...
CVE-2022-29534: Improper Authentication
An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header...
CVE-2022-29534
An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header...
Input validation
Exponent CMS before 2.6.0 has improper input validation in usersController.php...
CVE-2016-9022
Exponent CMS before 2.6.0 has improper input validation in usersController.php...
