CVE-2026-111352

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

PT-2022-7034 · Brocade · Brocade Fabric Os

Name of the Vulnerable Software and Affected Versions: Brocade Fabric OS versions prior to v9.1.1 Brocade Fabric OS versions prior to v9.0.1e Brocade Fabric OS versions prior to v8.2.3c Description: The issue allows a low-privilege webtools user to gain elevated admin rights by exploiting a...

Larvata Flygo 安全漏洞

Larvata Flygo is an attendance clocking software from Larvata Taiwan. Larvata Flygo contains Insecure Direct Object Reference has a security vulnerability that allows a remote attacker, after authenticating as an ordinary user, to arbitrarily access employee data by manipulating the employee ID i...

CVE-2021-21389

BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in...

File Store PRO 3.2 - Multiple Blind SQL Injections

| File Store PRO 3.2 Blind SQL Injection | || Download from: http://upoint.info/cgi/demo/fs/filestore.zip - Need admin rights: /confirm.php: code ifisset$GET"folder" && $GET"folder"!="" $folder=$GET"folder"; else exit"Bad Request"; ifisset$GET"id" && $GET"id"!="" $id=$GET"id"; else exit"Bad...