CVE-2025-47226

CVE-2025-47226 - Snipe-IT = v8.0.4 中的 IDOR 漏洞 🚨 Snipe-IT 中的不安全直接对象引用（IDOR）漏洞允许经过身份验证的用户通过篡改 locationid 来查看其他部门的资产信息。 ✍️ 发现者 Siripong Jintung GitHub: Sn1p3r-H4ck3r Linkedin: www.linkedin.com/in/siripong-j-885b652b6 , 进攻性安全专家 | Movaci Co., Ltd. 📋 PoC 摘要 字段| 详情 ---|--- CVE ID| CVE-2025-47226 产品|...

CVE-2026-67310 openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-44012 Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

Craft CMS is a content management system CMS. From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder fetches an asset by ID and returns its filename and complete folder hierarchy including volume handle, volume UID, folder names, folder UIDs, and folder URI paths without checking...