CVE-2025-4064

CVE-2025-4064 affects ScriptAndTools Online-Travling-System v1.0. The vulnerability resides in an unknown part of /admin/viewenquiry.php and exploits improper access controls. Reported as remotely initiable and public exploit disclosure exists. Multiple sources corroborate a critical issue affect...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to information disclosure (CVE-2022-22442)

Summary An information disclosure vulnerability due to improper access controls was addressed in InfoSphere Information Server. Vulnerability Details CVEID:CVE-2022-22442 DESCRIPTION: IBM InfoSphere Information Server could allow an authenticated user to access information restricted to users wit...

PT-2025-18169 · Unknown · Scriptandtools Online-Travling-System

Name of the Vulnerable Software and Affected Versions: ScriptAndTools Online-Travling-System version 1.0 Description: A critical vulnerability has been found in the software, affecting an unknown function of the file /admin/viewpackage.php. This leads to improper access controls, allowing for...

PT-2025-18167 · Unknown · Scriptandtools Online-Travling-System

Name of the Vulnerable Software and Affected Versions: ScriptAndTools Online-Travling-System version 1.0 Description: A critical issue has been identified, affecting the /admin/addadvertisement.php file, which leads to improper access controls. The issue can be exploited remotely. Recommendations...

PT-2025-18213 · Unknown · Khc-Invitation-Automation

Name of the Vulnerable Software and Affected Versions: KHC-INVITATION-AUTOMATION version 1.2 Description: The issue concerns a GitHub automation script where user data, including email addresses and Discord usernames, were exposed in API responses without proper access controls. This allowed...

PT-2025-18148

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 138 Mozilla Firefox ESR versions prior to 128.10 Mozilla Firefox ESR versions prior to 115.23 Thunderbird versions prior to 138 Thunderbird ESR versions prior to 128.10 Description The update mechanism in...

CVE-2025-4036

A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/github/xxyopen/novel/controller/author/AuthorController.java of the component Chapter Handler. The manipulation leads to improper access...

CVE-2025-4036

CVE-2025-4036 affects Novel 201206030, version 3.5.0, specifically the updateBookChapter function in Chapter Handler (AuthorController.java). The root cause is improper access controls, enabling a remote attack. Public exploit disclosure is noted across multiple feeds. Some sources (e.g., PT-2025...

CVE-2025-43862

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

CVE-2025-2101

CVE-2025-2101 (Edumall theme for WordPress) Unauthenticated Local File Inclusion via the template parameter of the edumall_lazy_load_template AJAX action affects Edumall

CVE-2024-12244

An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1...

CVE-2025-3667

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3674

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The...

CVE-2025-3675

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been rated as critical. Affected by this issue is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been...

CVE-2025-3668

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been declared as critical. This vulnerability affects the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has...

CVE-2025-32796

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disable apps through the API, even though the web UI button for this action is disabled and normal users are not permitted to make such changes...

CVE-2025-46535

Missing Authorization vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login and Registration: from n/a through 1.0.0...

The vulnerability of the Cisco Secure Email Gateway security system’s operating system, Cisco AsyncOS, allows a hacker to circumvent existing security restrictions.

The vulnerability of the Cisco Secure Email Gateway security system’s operating system, Cisco AsyncOS, is related to access control errors. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions remotely...

Exploit for OS Command Injection in Raisecom Msg2300_Firmware

This is a PoC exploit for CVE-2024-7120, a vulnerability in an u...

CVE-2024-12244

CVE-2024-12244†Missing Authorization in GitLab . The issue is an access-control flaw in GitLab Enterprise Edition (GitLab EE) that could allow a user to view certain restricted project information even when related features are disabled. Affected versions are GitLab EE 17.7 up to 17.9.7, 17.10 up...