CVE-2026-110125 waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm,...

CVE-2023-48381: Improper Limitation of a Pathname to a Restricted Directory

Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion LFI vulnerability in a special URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify...

PT-2021-20174

Name of the Vulnerable Software and Affected Versions Mitel MiContact Center Business versions 8.0.0.0 through 8.1.4.1 Mitel MiContact Center Business versions 9.0.0.0 through 9.3.1.0 Description The issue is related to the improper handling of tokens in the Software Development Kit, allowing an...

PT-2021-21577

Name of the Vulnerable Software and Affected Versions Flygo affected versions not specified Description The bulletin function of Flygo contains an Insecure Direct Object Reference IDOR issue. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific...

Oracle Mysql Security Updates (jan2018-3236628) 03 - Windows

Oracle MySQL is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:mysql"; ifdescription...

CVE-2014-9324: Undefined Security Weakness

The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors...