4052 matches found
WordPress plugin Awesome Support ไฟกๆฏๆณ้ฒๆผๆด
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...
5 Unexpected Devices You Didnโt Know Could Spread Malware
When you think of malware, your mind probably jumps to malicious downloads or email attachments. But it turnsโฆ...
CVE-2024-10366
An improper access control vulnerability IDOR exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other use...
SMF๏ผSimple Machines Forum๏ผ ่ทจ็ซ่ๆฌๆผๆด
SMF Simple Machines Forum is a free, open source community forum project by Simple Machines Open Source. A cross-site scripting vulnerability exists in SMF Simple Machines Forum version 2.1.4, which stems from improper manipulation of the Notice parameter in the ManageAttachments.php file, and...
CVE-2024-10366
An improper access control vulnerability IDOR exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other use...
CVE-2024-10366
The CVE-2024-10366 vulnerability affects danny-avila/librechat v0.7.5-rc2, where the delete-attachments endpoint does not verify that the attachment ID belongs to the current user. This IDOR allows any authenticated user (low privileges) to delete attachments of other users, with a network-style ...
CVE-2024-10366 IDOR in delete attachments in danny-avila/librechat
An improper access control vulnerability IDOR exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other use...
CVE-2024-10366 IDOR in delete attachments in danny-avila/librechat
An improper access control vulnerability IDOR exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other use...
CVE-2024-10366 IDOR in delete attachments in danny-avila/librechat
An improper access control vulnerability IDOR exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other use...
PT-2025-12040 ยท Librechat ยท Librechat
Name of the Vulnerable Software and Affected Versions: danny-avila/librechat version v0.7.5-rc2 Description: An improper access control vulnerability exists in the delete attachments functionality. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowi...
CVE-2024-10366: Authorization Bypass Through User-Controlled Key
An improper access control vulnerability IDOR exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other use...
Exploit for Missing Authorization in Directsoftware Order_Attachments_For_Woocommerce
๐ WooCommerce Arbitrary File Upload Exploit CVE-2024-9756...
SAP S4 HANA ๅฎๅ จๆผๆด
SAP S4 HANA is a software for improving database efficiency from SAP, a German company. An access control error vulnerability exists in SAP S4 HANA that stems from a failure to perform required access control checks and can be exploited by an attacker to delete attachments...
CVE-2024-13552: Improper Authorization
The SupportCandy โ Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on a user controlled key. This makes it possible for authenticated attackers to...
Linux Distros Unpatched Vulnerability : CVE-2024-30204
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. CVE-2024-30204 Note that Nessus relies on the presence of the package as...
CVE-2025-26319
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments...
CVE-2025-26319
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments...
Linux Distros Unpatched Vulnerability : CVE-2020-11879
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary non-RFC6068 mailto?attach=... parameter, a website or other source of mailto...
CVE-2025-26319: Unrestricted Upload of File with Dangerous Type
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments...
