PT-2025-43674

Name of the Vulnerable Software and Affected Versions GN4 Publishing System versions prior to 2.6 Description GN4 Publishing System contains an insecure direct object reference IDOR vulnerability via the API. Authenticated requests to the API’s object endpoints allow an authenticated user to...

CVE-2025-61907

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information tha...

CVE-2025-40676 Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC

Insecure Direct Object Reference IDOR in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure BBMRI-ERIC. This vulnerability allows an attacker to access or modify unauthorised resources by manipulating requests that use the 'userID' parameter in...

EUVD-2020-18350

Malware in sbrugna...

EUVD-2021-26244

Malware in sbrugna...

EUVD-2021-19515

Malware in sbrugna...

EUVD-2013-4207

Malware in sbrugna...

EUVD-2014-0263

Malware in sbrugna...

EUVD-2018-17038

Malware in sbrugna...

EUVD-2022-26446

Malicious code in bioql PyPI...

EUVD-2022-7155

Malicious code in bioql PyPI...

EUVD-2023-56164

Malicious code in bioql PyPI...

EUVD-2022-38837

Malicious code in bioql PyPI...

EUVD-2024-2546

Malicious code in bioql PyPI...

EUVD-2024-43136

Malicious code in bioql PyPI...

EUVD-2025-25308

Malicious code in bioql PyPI...

EUVD-2025-28981

Malicious code in bioql PyPI...

EUVD-2024-33946

Malicious code in bioql PyPI...

EUVD-2025-32281

The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated...

CVE-2025-9209

The CVE concerns RestroPress – Online Food Ordering System (WordPress) versions 3.0.0–3.1.9.2. Affected endpoint /wp-json/wp/v2/users exposes user private tokens and API data, enabling unauthenticated attackers to forge JWT tokens and authenticate as other users (including admins). This constitut...