Kimai's API invoice endpoint missing customer-level access control (IDOR)

Summary GET /api/invoices/id only checks the role-based viewinvoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLETEAMLEAD which grants viewinvoice can read all invoices in the system, including those belonging to customers assigned to...

CVE-2025-7591

A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System 1.3. Affected is an unknown function of the file view-invoice.php. The manipulation of the argument invid leads to sql injection. It is possible to launch the attack remotely. The exploit...

PHPGurukul Dairy Farm Shop Management System 多款产品安全漏洞

PHPGurukul Dairy Farm Shop Management System is a PHP and MySQL based dairy farm management system from PHPGurukul. A security vulnerability exists in version 1.3 of the PHPGurukul Dairy Farm Shop Management System, which originates from a SQL injection due to the incorrect manipulation of the...