114663 matches found
CVE-2026-15630
The Casdoor IAM platform is vulnerable to an authorization bypass in versions up to v4.2.0 (specifically noted as $\le$ v3.115.0 in some reports). The root cause is a desynchronization between the global authorization filter (routers/authzfilter.go) and downstream controllers (e.g., controllers/u...
CVE-2026-15630 CVE-2026-15630
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...
EUVD-2026-48418
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...
CVE-2026-15630
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...
CVE-2026-48013
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the "/api/action/media/external-link" endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel "uploadFromURL" flow validates target IPs against...
CVE-2026-48013
CVE-2026-48013 (Shopware) is an SSRF in the media external-link flow. Authenticated admins can cause server-side HEAD requests from the endpoint /api/_action/media/external-link to arbitrary internal IPs, bypassing the existing depth of IP checks used by the parallel uploadFromURL flow. The vulne...
CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
CVE-2026-47743
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...
CVE-2026-47743
The CVE-2026-47743 issue affects Shopper’s admin Livewire components prior to v2.8.0. The root causes are: (1) IDOR-like vulnerability where public Eloquent identifiers could be rewritten in the wire payload due to missing #[Locked], enabling targeting of arbitrary records; (2) leakage of plainte...
CVE-2026-47743
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...
CVE-2026-47743 Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...
EUVD-2026-48336
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...
CVE-2026-47743 Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...
CVE-2026-47743 Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...
GO-2026-5675 Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph
The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster...
CVE-2026-65897
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...
CVE-2026-24628
Administrator Cross Site Scripting XSS in Photo Gallery by Supsystic = 1.16.3 versions...
CVE-2026-65897
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...