114507 matches found
CVE-2026-111655 ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with...
CVE-2026-111655 ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with...
CVE-2026-111655
The ThinkAdmin think-plugs-admin software (through version 1.0.81 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The issue exists in the admin/file.edit endpoint, where non-super administrators can read or overwrite file records belonging to other administrators. By requestin...
EUVD-2026-103077
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with...
CVE-2026-111630
abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...
EUVD-2026-103052
abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...
CVE-2026-111630 abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations
abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...
CVE-2026-111630
The abp-next-admin software (versions 10.2.0 through 10.6.0 ) contains an Insecure Direct Object Reference (IDOR) vulnerability within the LINGYUN.Abp.AIManagement module. The root cause allows authenticated users with the Chat permission to access other users' AI chat conversations by supplying ...
CVE-2026-111630 abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations
abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...
CVE-2026-92263
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...
CVE-2026-92263 SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...
CVE-2026-92263 SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...
CVE-2026-92263
The SparkyFitness health and fitness tracker is vulnerable to OS command injection in versions prior to 1.6.0 . The flaw exists in the api/admin/backup/restore endpoint, where the application interpolates an uploaded filename directly into a shell command. An authenticated global administrator ca...
CVE-2026-93681 Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via displayname Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-93681
The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.1.0 . The root cause is insufficient input sanitization and output escaping associated with the display_name parameter. Authenticated at...
CVE-2026-18799
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team a...
EUVD-2026-102815
The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippe...
CVE-2026-18551
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API...
EUVD-2026-102751
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team a...