81 matches found
WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.26 - Subscriber+ Stored Payment Method Assignment vulnerability
Subscriber+ Stored Payment Method Assignment vulnerability discovered by m1w34p0n & krypt3d in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.26...
CVE-2026-58477
Sustainable Irrigation Platform SIP through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to...
CVE-2026-54361 MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records
MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegations, and shadow attributes. Several controller actions accepted user-supplied fields that should have remained server-controlled, including record identifiers and ownership-relat...
EUVD-2026-35104
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the tool update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId,...
EUVD-2026-30174
Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the configdata dictionary. Attackers can exploit insufficient deny-list filtering to...
The vulnerability of the ext4_write_info() function in the fs/ext4/super.c module of the Ext4 file system in the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the ext4writeinfo function in the fs/ext4/super.c module of the Ext4 file system in the Linux operating system is related to the pointer assignment. Exploiting this vulnerability could allow an attacker to cause a service failure...
The vulnerability of the dsa_switch_shutdown() function in the net/dsa/dsa2.c module exposes a flaw in the support for Linux kernel distributed architecture switches, allowing an attacker to trigger a service failure.
The vulnerability of the dsaswitchshutdown function in the net/dsa/dsa2.c module relates to the pointer assignment. Exploiting this vulnerability could allow an attacker to trigger a service failure...
CVE-2021-27582
org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment aka Autobinding vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in...
The vulnerability of the ravb_suspend() function in the drivers/net/ethernet/renesas/ravb_main.c file of the Linux kernel’s Ethernet adapter support driver allows a hacker to cause a service failure.
The vulnerability of the ravbsuspend function in the drivers/net/ethernet/renesas/ravbmain.c file of the Linux kernel’s Ethernet adapter support driver is related to the assignment of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...
GHSA-5448-V74M-7MV7 Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the...
Exploit for Expression Language Injection in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
ButtF - Backend Misconfiguration & Logic Flaw Exploitation Too...
CVE-2026-24140 MyTube has Mass Assignment via Settings Management
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings function accepts arbitrary key-value pairs without...
CVE-2018-4073
An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The the binary the endpoint /cgi-bin/EmbededAceTLSetTask.cgi is a very similar endpoint that is designed for use with setting table values th...
CVE-2024-41139
Incorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e. If a user who can log in to the PC where the product's Windows client is installed places a specially crafted DLL file in a specific folder, arbitrary code may be executed with SYSTEM privile...
CVE-2025-23970
Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booking: from n/a through = 6.1...
UliCMS 安全漏洞
UliCMS is a content management system CMS open source by UliCMS. The system supports features such as access control and WYSIWYG editing. A security vulnerability exists in UliCMS version 2023.1, which stems from an improper bulk assignment in UserController that could lead to authentication bypa...
EUVD-2019-7931
Malware in sbrugna...
EUVD-2019-3554
Malware in sbrugna...