PT-2025-40599

Name of the Vulnerable Software and Affected Versions OpenSupports version 4.11.0 Description The software exposes an endpoint that allows modification of the 'supervised users' list for any account without verifying ownership. This allows a Level 1 staff member to alter the supervision...

GTT GROUP OpenSIAC 授权问题漏洞

GTT GROUP OpenSIAC is a digital service management platform from GTT GROUP, Inc. GTT GROUP OpenSIAC suffers from an authorization issue vulnerability that stems from improper authentication and could lead to an attacker impersonating a user using the Cl@ve authentication method...

CVE-2025-10989

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorization. The attack can be initiated remotely. The exploit has bee...

Portábilis i-Educar 授权问题漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. An authorization issue vulnerability exists in Portábilis i-Educar 2.10 and earlier versions, which stems from the fact that manipulation of the file/periodo-lancamento may result in...

wisdom-education 授权问题漏洞

wisdom-education is a cloud intelligence education platform by zhuimengshaonian individual developer. There is an authorization issue vulnerability in wisdom-education 1.0.4 and earlier versions, which originates from the function in the file...

CVE-2025-11048

Portabilis i-Educar

CVE-2025-10992 roncoo roncoo-pay lookupList improper authorization

A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly...

Portábilis i-Educar 授权问题漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. An authorization issue vulnerability exists in Portábilis i-Educar 2.10 and earlier versions, which stems from improper authorization of the parameter alunoid in the file...

WordPress plugin Acclectic Media Organizer 安全漏洞

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An authorization missing vulnerability exists in the WordPress plugin Acclectic Media Organizer...

yudao-cloud 授权问题漏洞

yudao-cloud is a backend management system for YunaiV individual developers. An authorization issue vulnerability exists in yudao-cloud version 2025.09 and earlier, which stems from improper authorization of the parameter contactId in the file /crm/contact/transfer, which could lead to remote...

Ruoyi 授权问题漏洞

Ruoyi is a backend management system for Ruoyi's individual developers. An authorization issue vulnerability exists in Ruoyi version 4.8.1 and prior versions, which stems from an incorrect operation of the parameter userIds in the file /system/role/authUser/selectAll, which may result in improper...

Tutorials Website Employee Management System 授权问题漏洞

Tutorials Website Employee Management System is an employee management system from Tutorials Website, Inc. Tutorials Website Employee Management System has an authorization issue vulnerability that stems from improper authorization of the HTTP request processing component in file...

WordPress plugin TheGem 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

CVE-2025-10979

A weakness has been identified in JeecgBoot up to 3.8.2. The impacted element is an unknown function of the file /sys/role/exportXls. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be...

JeecgBoot 授权问题漏洞

JeecgBoot is a Java low-code platform for enterprise web applications from China National Torch Jeecg. An authorization issue vulnerability exists in JeecgBoot 3.8.2 and earlier versions, which stems from incorrect manipulation of the parameter departId in file/api/getDepartUserList, which could...

JeecgBoot 授权问题漏洞

JeecgBoot is an open source low-code development platform based on the code generator of Beijing National Torch Information Technology Co. A security vulnerability exists in JeecgBoot 3.8.2 and earlier versions, which stems from improper authorization of the ids parameter in the...

JeecgBoot 授权问题漏洞

JeecgBoot is a Java low-code platform for enterprise web applications from China National Torch Jeecg. An authorization issue vulnerability exists in JeecgBoot 3.8.2 and earlier versions, which stems from improper authorization in the file /sys/user/exportXls in the component Filter Handler, whic...

CVE-2025-59827 FlagForgeCTF is Missing Authorization in main-v2

Flag Forge is a Capture The Flag CTF platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges e.g., Staff to themselves. This could lead to privilege escalation and impersonation of administrative...

CVE-2025-59827 FlagForgeCTF is Missing Authorization in main-v2

Flag Forge is a Capture The Flag CTF platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges e.g., Staff to themselves. This could lead to privilege escalation and impersonation of administrative...

CVE-2025-58681

Missing Authorization vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Quotes: from n/a through = 1.2.4...