Lucene search
+L

90553 matches found

OSV
OSV
added 2026/06/12 6:28 p.m.15 views

GHSA-6XP4-CF37-PPJH Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Summary /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builders and workspace-scoped builders builder.apps set but builder.global unset. The controller th...

9CVSS5.4AI score0.00292EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/06/12 6:28 p.m.19 views

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Summary /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builders and workspace-scoped builders builder.apps set but builder.global unset. The controller th...

9CVSS5.4AI score0.00292EPSS
SaveExploits0References3Affected Software1
EUVD
EUVD
added 2026/06/12 6:28 p.m.23 views

EUVD-2026-32590

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign...

9CVSS5.2AI score0.00292EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/12 6:23 p.m.18 views

EUVD-2026-32606

Budibase: Unanchored Regex in matchers.ts Allows CSRF Bypass via Query String Injection in Budibase Worker...

6.5CVSS5.2AI score0.00115EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/06/12 6:22 p.m.18 views

CVE-2026-10715 Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint

Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary postid to POST /admin/posttype//drafts and overwrite the draft associated with another user's post...

5.1CVSS5.5AI score0.00238EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/06/12 6:22 p.m.44 views

CVE-2026-10715 Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint

Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary postid to POST /admin/posttype//drafts and overwrite the draft associated with another user's post...

5.1CVSS0.00238EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/12 6:14 p.m.11 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the schemeadmin flag in group syncable link and patch endpoints. An attacker can gain unauthorized administrative privileges by sending crafted API requests. Remediation Upgrade...

8.8CVSS5.8AI score0.0031EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/12 5:16 p.m.33 views

CVE-2026-7387

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Mattermost fails to require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselv...

8.8CVSS0.0031EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/12 3:54 p.m.28 views

EUVD-2026-36503

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Mattermost fails to require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselv...

8.8CVSS5.3AI score0.0031EPSS
SaveExploits0References1
OSV
OSV
added 2026/06/12 3:54 p.m.8 views

CVE-2026-7387 Mattermost group syncable endpoints allow privilege escalation via scheme_admin

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Mattermost fails to require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselv...

8.8CVSS6AI score
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/06/12 3:54 p.m.15 views

CVE-2026-7387 Mattermost group syncable endpoints allow privilege escalation via scheme_admin

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Mattermost fails to require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselv...

8.8CVSS5.3AI score0.0031EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/12 3:54 p.m.43 views

CVE-2026-7387 Mattermost group syncable endpoints allow privilege escalation via scheme_admin

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Mattermost fails to require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselv...

8.8CVSS0.0031EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/12 11:16 a.m.15 views

CVE-2026-11849

The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote attackers to exploit hard-coded credentials to gain administrative privileges on the database...

9.8CVSS0.0035EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/06/12 9:47 a.m.36 views

CVE-2026-11849 IEI Integration Corp|iRM-IEI Remote Management - Hard-coded Credentials

The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote attackers to exploit hard-coded credentials to gain administrative privileges on the database...

9.8CVSS0.0035EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/12 9:47 a.m.20 views

EUVD-2026-36410

The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote attackers to exploit hard-coded credentials to gain administrative privileges on the database...

9.8CVSS5.4AI score0.0035EPSS
SaveExploits0References2
CVE
CVE
added 2026/06/12 9:47 a.m.29 views

CVE-2026-11849

The CVE-2026-11849 entry concerns IEI Integration Corp’s iRM-IEI Remote Management with a hardcoded credentials flaw. Affected component: the iRM-IEI Remote Management database (product/vendor specified). Root cause: hardcoded credentials allowing unauthenticated remote access. Impact: attacker c...

9.8CVSS5.5AI score0.0035EPSS
SaveExploits0References2
CVE
CVE
added 2026/06/12 6:0 a.m.81 views

CVE-2026-9269

The CVE pertains to the WordPress plugin “Secure Copy Content Protection and Content Locking” prior to version 5.1.5, which fails to sanitize and escape certain settings. This enables Stored XSS for high-privilege users (e.g., admin), even when unfiltered_html is disallowed (such as in multisite ...

3.5CVSS5.2AI score0.00145EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/12 6:0 a.m.11 views

CVE-2026-9269 Secure Copy Content Protection and Content Locking < 5.1.5 - Admin+ Stored XSS via ays_sccp_sub_icon_image Parameter

The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...

5.2AI score0.00145EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/12 6:0 a.m.42 views

CVE-2026-9269 Secure Copy Content Protection and Content Locking < 5.1.5 - Admin+ Stored XSS via ays_sccp_sub_icon_image Parameter

The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...

0.00145EPSS
SaveExploits0References1
SUSE CVE
SUSE CVE
added 2026/06/12 2:32 a.m.17 views

SUSE CVE-2026-8863

Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the...

7.8CVSS6AI score0.0011EPSS
SaveExploits0References3
Rows per page
Query Builder