56 matches found
EUVD-2026-14696
A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This affects an unknown function of the file /api/System.php of the component API Module. The manipulation of the argument url leads to...
Jeson Customer Relationship Management System 代码问题漏洞
Jeson Customer Relationship Management System is a lightweight customer relationship management system developed by DefaultFunction’s individual developer. The Jeson Customer Relationship Management System has code vulnerabilities; these vulnerabilities stem from incorrect handling of parameters ...
PT-2026-27304
Name of the Vulnerable Software and Affected Versions DefaultFuction Jeson-Customer-Relationship-Management-System affected versions not specified Description A security issue has been identified in the API Module component of DefaultFuction Jeson-Customer-Relationship-Management-System...
CVE-2026-2692: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in CoCoTeaNet CyreneAdmin up to 1.3.0. This affects an unknown part of the file /api/system/user/getAvatar of the component Image Handler. Performing a manipulation of the argument Avatar results in path traversal. The attack can be initiated remotely. The exploit has be...
CVE-2026-2693: Improper Authorization
A vulnerability was determined in CoCoTeaNet CyreneAdmin up to 1.3.0. This vulnerability affects unknown code of the file /api/system/dashboard/getCount of the component System Info Endpoint. Executing a manipulation can lead to improper authorization. The attack can be launched remotely. The...
CVE-2026-2663: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in Alixhan xh-admin-backend up to 1.7.0. This issue affects some unknown processing of the file /frontend-api/system-service/api/system/role/query of the component Database Query Handler. Such manipulation of the argument prop leads to sql injection. It ...
CVE-2025-63387: Improper Access Control
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous...
CVE-2025-63388: Origin Validation Error
A Cross-Origin Resource Sharing CORS misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any...
EUVD-2022-6034
Malicious code in bioql PyPI...
CVE-2024-44808
An issue in Vypor Attack API System v.1.0 allows a remote attacker to execute arbitrary code via the user GET parameter...
CVE-2023-45277
Yamcs 5.8.6 is vulnerable to directory traversal issue 1 of 2. The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files...
CVE-2025-28057: Improper Neutralization of Special Elements used in an SQL Command
owl-admin v3.2.2 to v4.10.2 is vulnerable to SQL Injection in /admin-api/system/adminmenus/saveorder...
CVE-2025-4552: Unverified Password Change
A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/system/user/1/password. The manipulation leads to unverified password change. The attack can be launched remotely. The exploi...
CVE-2025-3801
A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Setting Handler. The manipulation of the argument Homepage Content/About System/Footer leads to cross site scripting. It is possible to...
CVE-2025-3135: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in fcbazzm ics-park Smart Park Management System 2.1. This vulnerability affects unknown code of the file /api/system/dept/update. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the...
CVE-2024-10109: Incorrect Authorization
A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of...
CVE-2025-2218: Improper Access Control
A vulnerability has been found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This vulnerability affects unknown code of the file /api/system/other of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The...
CVE-2024-5719 Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability
Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Although authentication is required to exploit this vulnerability, the existing...
PT-2024-31259
Name of the Vulnerable Software and Affected Versions Vypor Attack API System version 1.0 Description An issue in the Vypor Attack API System allows a remote attacker to execute arbitrary code via the user GET parameter. This enables the attacker to run any code, posing a significant security ris...