CVE-2025-2334

CVE-2025-2334 concerns 274056675 springboot-openai-chatgpt. The issue affects the Chat History Handler’s deleteChat function (file: /api/mjkj-chat/chat/ai/delete/chat). Manipulating the chatListId argument leads to improper access controls, enabling remote initiation. Public exploit information i...

CVE-2025-1707

The Review Schema plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.4 via post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing...

CVE-2025-2218 LoveCards LoveCardsV2 Setting other access control

A vulnerability has been found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This vulnerability affects unknown code of the file /api/system/other of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The...

CVE-2025-26660

SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to...

CVE-2025-26660 Broken Access Control in SAP Fiori apps (Posting Library)

SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to...

SAP Fiori 安全漏洞

SAP Fiori, a user experience UX design system for SAP applications from SAP, Germany, provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, providing a consistent, innovative experience for creators and users. A security vulnerabili...

CVE-2025-2089

A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of the file /personal/updateInfo of the component com.siro.mall.controller.mall.UserController. The manipulation of the argument userId leads ...

CVE-2025-2090

A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/add-subadmin.php of the component Sub Admin Handler. The manipulation leads to improper access controls. The attack may be...

CVE-2025-2121

A vulnerability classified as critical has been found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected is an unknown function of the component File Storage. The manipulation leads to improper access controls. The attack can only be done within the local network. The exploit has been...

CVE-2025-2121 Thinkware Car Dashcam F800 Pro File Storage access control

A vulnerability classified as critical has been found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected is an unknown function of the component File Storage. The manipulation leads to improper access controls. The attack can only be done within the local network. The exploit has been...

CVE-2025-2121

CVE-2025-2121 affects Thinkware Car Dashcam F800 Pro up to 20250226. The vulnerability resides in the File Storage component, with an unknown function enabling improper access controls exploitable from the local network. The exploit has been publicly disclosed and the vendor has not responded. A ...

PT-2025-10449 · Thinkware · Thinkware Car Dashcam F800 Pro

Name of the Vulnerable Software and Affected Versions: Thinkware Car Dashcam F800 Pro versions up to 20250226 Description: A critical vulnerability has been found in the File Storage component of the Thinkware Car Dashcam F800 Pro, affecting an unknown function. The manipulation leads to improper...

Mozilla: [Privilege Escalation] User can Pin|Unpin Any Comment on Any Project or Locale

A vulnerability was discovered in the Pontoon application where any user could pin or unpin comments on any project or locale, despite lacking the necessary privileges. This was possible due to the lack of proper access controls in the backend code handling the pin and unpin functionality...

CVE-2025-2090

A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/add-subadmin.php of the component Sub Admin Handler. The manipulation leads to improper access controls. The attack may be...

CVE-2025-2090

CVE-2025-2090 affects PHPGurukul Pre-School Enrollment System 1.0, specifically the Sub Admin Handler component and its /admin/add-subadmin.php functionality. The issue is improper access controls in that file, enabling potential unauthorized actions. Multiple connected sources (NVD/NVD-derived f...

CVE-2025-2089 StarSea99 starsea-mall com.siro.mall.controller.mall.UserController updateInfo updateUserInfo access control

A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of the file /personal/updateInfo of the component com.siro.mall.controller.mall.UserController. The manipulation of the argument userId leads ...

CVE-2025-1881

A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Video Footage/Live Video Stream. The manipulation leads to improper access controls. The attack can be launched remotel...

CVE-2024-53011

Information disclosure may occur due to improper permission and access controls to Video Analytics engine...

Improper Authorization

mautic/core is vulnerable to Improper Authorization. The vulnerability is due to improper enforcement of access controls, allowing any authenticated user to bypass reporting permissions and access all reports via the API...

Linux Distros Unpatched Vulnerability : CVE-2022-31022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pav...