PT-2025-18247 · Unknown · Phpgurukul Pre-School Enrollment System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Pre-School Enrollment System version 1.0 Description: A critical vulnerability has been found in the PHPGurukul Pre-School Enrollment System, affecting an unknown functionality of the file /admin/edit-subadmin.php. The manipulation...

PT-2025-18280 · Unknown · Weitong Mall

Name of the Vulnerable Software and Affected Versions: Weitong Mall version 1.0.0 Description: A critical issue was found in the Product Statistics Handler component, specifically affecting the /queryTotal file. The manipulation of the isDelete argument with the input 1 leads to improper access...

CVE-2025-46552 KHC-INVITATION-AUTOMATION Sensitive User Information Leakage in Invitation Automation

KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on version 1.2, a vulnerability was identified where user data, including email addresses and Discord usernames, were exposed in API responses...

CVE-2025-4067

A vulnerability classified as critical has been found in ScriptAndTools Online-Travling-System 1.0. Affected is an unknown function of the file /admin/viewpackage.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed ...

CVE-2025-4066

A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/addpackage.php. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been...

CVE-2025-4067

CVE-2025-4067 affects ScriptAndTools Online-Travling-System 1.0. A vulnerability in an unknown function within /admin/viewpackage.php leads to improper access controls. This enables remote exploitation; the exploit has been disclosed publicly. Reports vary on remediation status, with some sources...

CVE-2025-4066

CVE-2025-4066 affects ScriptAndTools Online-Travling-System 1.0. The issue resides in the /admin/addpackage.php processing, with the underlying cause described as improper access controls. Multiple connected sources indicate remote exploitation possibilities and public disclosure. Some entries ex...

CVE-2025-4065 ScriptAndTools Online-Travling-System addadvertisement.php access control

A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/addadvertisement.php. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been...

CVE-2025-4064

A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/viewenquiry.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-4064

CVE-2025-4064 affects ScriptAndTools Online-Travling-System v1.0. The vulnerability resides in an unknown part of /admin/viewenquiry.php and exploits improper access controls. Reported as remotely initiable and public exploit disclosure exists. Multiple sources corroborate a critical issue affect...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to information disclosure (CVE-2022-22442)

Summary An information disclosure vulnerability due to improper access controls was addressed in InfoSphere Information Server. Vulnerability Details CVEID:CVE-2022-22442 DESCRIPTION: IBM InfoSphere Information Server could allow an authenticated user to access information restricted to users wit...

PT-2025-18169 · Unknown · Scriptandtools Online-Travling-System

Name of the Vulnerable Software and Affected Versions: ScriptAndTools Online-Travling-System version 1.0 Description: A critical vulnerability has been found in the software, affecting an unknown function of the file /admin/viewpackage.php. This leads to improper access controls, allowing for...

PT-2025-18167 · Unknown · Scriptandtools Online-Travling-System

Name of the Vulnerable Software and Affected Versions: ScriptAndTools Online-Travling-System version 1.0 Description: A critical issue has been identified, affecting the /admin/addadvertisement.php file, which leads to improper access controls. The issue can be exploited remotely. Recommendations...

PT-2025-18213 · Unknown · Khc-Invitation-Automation

Name of the Vulnerable Software and Affected Versions: KHC-INVITATION-AUTOMATION version 1.2 Description: The issue concerns a GitHub automation script where user data, including email addresses and Discord usernames, were exposed in API responses without proper access controls. This allowed...

PT-2025-18148

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 138 Mozilla Firefox ESR versions prior to 128.10 Mozilla Firefox ESR versions prior to 115.23 Thunderbird versions prior to 138 Thunderbird ESR versions prior to 128.10 Description The update mechanism in...

CVE-2025-4036

A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/github/xxyopen/novel/controller/author/AuthorController.java of the component Chapter Handler. The manipulation leads to improper access...

CVE-2025-4036

CVE-2025-4036 affects Novel 201206030, version 3.5.0, specifically the updateBookChapter function in Chapter Handler (AuthorController.java). The root cause is improper access controls, enabling a remote attack. Public exploit disclosure is noted across multiple feeds. Some sources (e.g., PT-2025...

CVE-2025-43862

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

CVE-2025-2101

CVE-2025-2101 (Edumall theme for WordPress) Unauthenticated Local File Inclusion via the template parameter of the edumall_lazy_load_template AJAX action affects Edumall

CVE-2024-12244

An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1...