CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-103671

The AmazonPay Plugin for the EC-CUBE 4 series is vulnerable to an external control of assumed-immutable web parameter issue (CWE-472). An attacker can exploit this flaw to redirect users to an arbitrary website during the ordering process, potentially leading to the theft of user account informat...

CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

EUVD-2026-100939

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-108473

Multiple TP-Link Kasa devices are vulnerable to an improper authentication vulnerability within the local device-management protocol. An unauthenticated adjacent-network attacker can send management instructions without proper authorization, enabling unauthorized modification of device states or ...

EUVD-2026-100759

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state o...

PT-2026-113722

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-82287

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

CVE-2026-82287: Permissive Cross-domain Policy with Untrusted Domains

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

EUVD-2026-55874

SAP Manufacturing Integration and Intelligence MII does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker...

CVE-2026-58244 Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII)

SAP Manufacturing Integration and Intelligence MII does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker...

PT-2026-70034

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence MII affected versions not specified Description SAP Manufacturing Integration and Intelligence MII fails to perform required authorization checks on certain application functions. This allows an...

CVE-2026-54105

The CVE concerns CVE-2026-54105 affecting the GAO EPDS and CBCA EDS systems. The vulnerability arises from the update-profile/ API endpoint, where a remote, unauthenticated attacker can supply an arbitrary user_id and receive a JSON response containing account-specific information, including the ...

CVE-2026-54105 U.S. GAO EPDS and CBCA EDS user information disclosure

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a reque...

PT-2026-50705

Name of the Vulnerable Software and Affected Versions U.S. GAO Electronic Protest Docketing System EPDS affected versions not specified U.S. CBCA Electronic Docketing System EDS affected versions not specified Description The U.S. Government Accountability Office GAO Electronic Protest Docketing...

CVE-2026-35062

An authenticated iControl SOAP user may be able to obtain information of other accounts. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2018-25354: Cross-Site Request Forgery (CSRF)

Joomla Component jomres 9.11.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information by tricking authenticated users into visiting malicious pages. Attackers can craft HTML forms targeting the account/index endpoint with hidden fields to chan...

F5 Networks BIG-IP : iControl SOAP vulnerability (K000159021)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.1 / 17.5.1.4 / 21.0.0.1. It is, therefore, affected by a vulnerability as referenced in the K000159021 advisory. An authenticated iControl SOAP user may be able to obtain information of other accounts. CVE-2026-3506...

CVE-2018-25336 jCart for OpenCart 2.3.0.2 Cross-Site Request Forgery

jCart for OpenCart 2.3.0.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information without authentication. Attackers can craft malicious HTML forms targeting endpoints , and to change user credentials, passwords, and affiliate account details...

CVE-2018-25336: Cross-Site Request Forgery (CSRF)

jCart for OpenCart 2.3.0.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information without authentication. Attackers can craft malicious HTML forms targeting endpoints , and to change user credentials, passwords, and affiliate account details...