CVE-2026-63763 SurrealDB before 2.5.0 Privilege Escalation via Future Fields

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

PT-2022-11369 · Comodo +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions 3.0.0 beta releases prior to beta6 Description: The issue concerns a web-based IT Service Management tool where the ajax.render.php?operation=wizard helper page did not properly escape user-supplied parameters, allowing...