EUVD-2026-102495

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read...

CVE-2026-111351

The metasfresh software (versions through 5.175) is vulnerable to a missing record-level authorization flaw in the BoardRestController component. This vulnerability allows authenticated low-privilege users to bypass role and organization access checks by interacting with the /rest/api/board REST ...

CVE-2026-111351 metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read...

Mini Notice Board SQL Injection Vulnerability

Mini Notice Board 1.1 is an online bulletin board application that primarily facilitates the posting of trading announcements. A SQL injection vulnerability exists in the addcard.php page of Mini Notice Board version 1.1, which can be exploited by an attacker to compromise the application, access...

CVE-2012-2269

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary field to apps/contacts/ajax/addcard.php, 2 the parameter parameter to apps/contacts/ajax/addproperty.php, 3 the name parameter to...