EUVD-2026-49377

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...

CVE-2025-51479

Authorization bypass in updateusergroup in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks...

CVE-2024-40039

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/userGroupdeal.php?mudi=del...

idcCMS Security Breach

Net Titanium Technology idcCMS Net Titanium IDC Cloud Management Agent System is a cloud management agent system from China's Net Titanium Technology Net Titanium Technology. A security vulnerability exists in idcCMS v1.35, which originates from a cross-site request forgery vulnerability in the...

Authentication flaw

Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With:...

CVE-2022-39267

Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With:...

CVE-2018-18755: Improper Neutralization of Special Elements used in an SQL Command

K-iwi Framework 1775 has SQL Injection via the admin/user/group/update usergroupid parameter or the admin/user/user/update userid parameter...

PT-2018-14629

Name of the Vulnerable Software and Affected Versions K-iwi Framework version 1775 Description The issue concerns SQL Injection, which can be exploited via specific parameters in certain endpoints. The vulnerable parameters are user group id in the "admin/user/group/update" endpoint and user id i...

PT-2018-18650

Name of the Vulnerable Software and Affected Versions enhavo version 0.4.0 Description The issue allows for a cross-site scripting XSS attack via a user-group that contains executable JavaScript code in the user-group name. This attack is launched when a victim visits the "admin user group" page...

CVE-2018-8832: Improper Neutralization of Input During Web Page Generation

enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...