245 matches found
CVE-2025-64067
Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data e.g., user profiles, project records fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This...
Insecure Direct Object Reference (IDOR)
liferay-portal is vulnerable to an Insecure Direct Object Reference IDOR vulnerability. The vulnerability is due to the workflow definition API exposing resources based on user-supplied names without enforcing authorization checks, where the API resolves workflow definitions directly by name...
CVE-2025-64063
Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate...
CVE-2025-64065
The Primakon Pi Portal 1.0.18 API /api/V2/ppudfvadmin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH...
CVE-2025-64067
CVE-2025-64067 affects Primakon Pi Portal 1.0.18 APIs where endpoints that return object-specific or filtered data fail to verify that the requester is authorized for the target data. This enables unauthorized access through: (1) Direct ID manipulation/IDOR by altering identifiers like user_id or...
CVE-2025-12349
The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the...
CVE-2025-63291
When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely identify the data being requested by the caller. The Alteryx server did not check whether the authenticated user had permission to access the specified MongoDB object ID. By specifying...
PT-2025-46717
Name of the Vulnerable Software and Affected Versions DinukaNavaratna Dee Store version 1.0 Description A flaw exists in DinukaNavaratna Dee Store version 1.0 that can lead to missing authorization due to manipulation. The issue is present in an unknown function and can be exploited remotely. The...
WordPress All in One Time Clock Lite plugin unauthorized access vulnerability
WordPress All in One Time Clock Lite plugin is a plugin for tracking employee attendance and supports clock-in record management for employees, volunteers and contractors. An unauthorized access vulnerability exists in WordPress All in One Time Clock Lite plugin, which stems from a lack of...
CVE-2025-41341
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'iddenuncia' and 'seguro' in '/backend/api/buscarUsuarioByDenuncia.php'...
CanalDenuncia App 安全漏洞
CanalDenuncia App is a reporting channel application from the Spanish company CanalDenuncia. A security vulnerability exists in CanalDenuncia App, which stems from a lack of authorization checking, which allows an attacker to access other user information by sending a POST request to parameter...
CVE-2025-60982
IDOR vulnerability in Educare ERP 1.0 2025-04-22 allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not enforce proper authorization checks, allowing authenticated users to access or modify data belonging to other users by changing object...
EUVD-2005-0410
Malware in sbrugna...
EUVD-2007-1998
Malware in sbrugna...
EUVD-2021-12028
Malware in sbrugna...
EUVD-2021-14534
Malware in sbrugna...
EUVD-2014-0698
Malware in sbrugna...
EUVD-2014-7699
Malware in sbrugna...