CVE-2026-109184

The software jshERP through version 3.6 is vulnerable to an improper authorization (CWE-862) flaw. Low-privilege authenticated users can bypass data scope restrictions to read any settlement account ledger by providing an arbitrary accountId via the GET /account/findAccountInOutList endpoint. Thi...

EUVD-2026-97388

jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to vie...

CVE-2026-107856

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw...

CVE-2026-107856 CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw...

CVE-2026-107856 CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw...

EUVD-2026-95984

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw...

CVE-2026-73303 Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)

Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can...

MAL-2025-48685 Malicious code in gitlab-accountid (npm)

The package communicates with a domain associated with malicious activity...

EUVD-2008-5342

Malware in sbrugna...

EUVD-2004-1667

Malware in sbrugna...

AMTT Hotel Broadband Operation System 注入漏洞

AMTT Hotel Broadband Operation System is a hotel broadband operation system from China's AmTech Century AMTT. An injection vulnerability exists in AMTT Hotel Broadband Operation System HiBOS 3.0.3.151204 and earlier versions, which originates from the parameter AccountID in the file...

PT-2024-16725

Name of the Vulnerable Software and Affected Versions AMTT Hotel Broadband Operation System versions up to 3.0.3.151204 Description A critical issue has been found in the AMTT Hotel Broadband Operation System. It affects an unknown function of the file /manager/frontdesk/online status.php. The...

CVE-2024-11051: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in AMTT Hotel Broadband Operation System up to 3.0.3.151204. It has been classified as critical. Affected is an unknown function of the file /manager/frontdesk/onlinestatus.php. The manipulation of the argument AccountID leads to sql injection. It is possible to launch t...

Malicious code in sap-accountid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d80cf1beddae1149d89422bd3b18a14427df5e924a6ba9c01f0a19c33f69ac69 The OpenSSF Package Analysis project identified 'sap-accountid' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2020-13168

SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter...

Design/Logic Flaw

SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter...

CVE-2020-13168

SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter...

PT-2020-13369

Name of the Vulnerable Software and Affected Versions SysAid version 20.1.11b26 Description The issue allows for reflected XSS via the accountid parameter in the "ForgotPassword.jsp" page. Recommendations For version 20.1.11b26, avoid using the accountid parameter in the ForgotPassword.jsp page...

CVE-2020-13168: Improper Neutralization of Input During Web Page Generation

SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter...

extras.ky3.com XSS vulnerability

Open Bug Bounty ID: OBB-647891 Description| Value ---|--- Affected Website:| extras.ky3.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...