36 matches found
Access control issue in AlekSIS-Core
An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...
PYSEC-2026-767 Access control issue in AlekSIS-Core
An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...
aleksis-core (>=3.0.0b0, <=3.0.0b2), doccano (>=1.8.4, <=1.8.5) +3 more potentially affected by CVE-2026-27982 via django-allauth (0.52.0)
django-allauth PYPI version 0.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-core =3.0.0b0, =1.8.4, =1.8.4.1, =3.11.8, =1.9.0, =1.10.2 Source cves: CVE-2026-27982 Source advisory: OSV:GHSA-2JPR-83RG-V...
aleksis (>=2023.6.0b2, <=2023.6.1), aleksis-app-buelleten (>=2.0.0.dev1, <=2.0.0.dev2) +6 more potentially affected by CVE-2026-27982 via django-allauth (0.54.0)
django-allauth PYPI version 0.54.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis =2023.6.0b2, =2.0.0.dev1, =3.1.0, =6.0.0rc1, =0.4.2, =4.1.0, =0.6.0, =0.24.0 - nemo-allauth 1.11.0 Source cves:...
aleksis (>=2023.6.0b2, <=2023.6.1), aleksis-app-buelleten (>=2.0.0.dev1, <=2.0.0.dev2) +6 more potentially affected by CVE-2025-65431 via django-allauth (0.54.0)
django-allauth PYPI version 0.54.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis =2023.6.0b2, =2.0.0.dev1, =3.1.0, =6.0.0rc1, =0.4.2, =4.1.0, =0.6.0, =0.24.0 - nemo-allauth 1.11.0 Source cves:...
aleksis-core (>=3.0.0b0, <=3.0.0b2), doccano (>=1.8.4, <=1.8.5) +3 more potentially affected by CVE-2025-65431 via django-allauth (0.52.0)
django-allauth PYPI version 0.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-core =3.0.0b0, =1.8.4, =1.8.4.1, =3.11.8, =1.9.0, =1.10.2 Source cves: CVE-2025-65431 Source advisory: OSV:GHSA-8M3C-C723-H...
aleksis-core (>=3.0.0b0, <=3.0.0b2), doccano (>=1.8.4, <=1.8.5) +3 more potentially affected by CVE-2025-65430 via django-allauth (0.52.0)
django-allauth PYPI version 0.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-core =3.0.0b0, =1.8.4, =1.8.4.1, =3.11.8, =1.9.0, =1.10.2 Source cves: CVE-2025-65430 Source advisory: OSV:GHSA-QHMC-3MVR-F...
aleksis (>=2023.6.0b2, <=2023.6.1), aleksis-app-buelleten (>=2.0.0.dev1, <=2.0.0.dev2) +6 more potentially affected by CVE-2025-65431 via django-allauth (0.54.0)
django-allauth PYPI version 0.54.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis =2023.6.0b2, =2.0.0.dev1, =3.1.0, =6.0.0rc1, =0.4.2, =4.1.0, =0.6.0, =0.24.0 - nemo-allauth 1.11.0 Source cves:...
aleksis-core (>=3.0.0b0, <=3.0.0b2), doccano (>=1.8.4, <=1.8.5) +3 more potentially affected by CVE-2025-65431 via django-allauth (0.52.0)
django-allauth PYPI version 0.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-core =3.0.0b0, =1.8.4, =1.8.4.1, =3.11.8, =1.9.0, =1.10.2 Source cves: CVE-2025-65431 Source advisory: OSV:PYSEC-2025-111...
EUVD-2025-7678
Malicious code in bioql PyPI...
EUVD-2022-5974
Malicious code in bioql PyPI...
CVE-2022-29773
An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...
CVE-2025-25683
AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1...
CVE-2025-25683
AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1...
aleksis (>=2023.1.0b0, <=2023.6.0b1), aleksis-app-alsijil (>=2.0.0a3.dev0, <=2.0.0rc7.post0) +9 more potentially affected by CVE-2025-25683 via aleksis-core (>=3.0.0b3, <=3.0.0)
aleksis-core PYPI version =3.0.0b3, =2023.1.0b0, =2.0.0a3.dev0, =1.0.7.dev0, =2.0.0b0, =2.0.0b0, =2.0.0b0, =2.0.0b0, =2.0.0a1, =1.0.0, =2.0.0b0, =2.1.0.dev1 Source cves: CVE-2025-25683 Source advisory: SNYK:PYTHON-ALEKSISCORE-9486554...
Files or Directories Accessible to External Parties
Overview aleksis-core is a This is the core of the AlekSIS framework and the official distribution see below. It bundles functionality for all apps, and utilities for developers and administrators. Affected versions of this package are vulnerable to Files or Directories Accessible to External...
AlekSIS-Core security vulnerabilities
AlekSIS-Core is a school information system from AlekSIS, Inc. A security vulnerability exists in AlekSIS-Core versions 3.0 through 3.2.1, which stems from improperly controlled access and could result in unauthorized access to PDF files...
PT-2025-11108
Name of the Vulnerable Software and Affected Versions: AlekSIS-Core versions 3.0 through 3.2.1 Description: The issue is related to Incorrect Access Control, allowing unauthenticated users to access all PDF files. Recommendations: For AlekSIS-Core versions 3.0 through 3.2.1, consider restricting...
CVE-2025-25683: Improper Access Control
AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1...
