QNAP VioStor 授权问题漏洞

QNAP VioStor is a software for storing and managing video surveillance systems from Taiwan, China-based QNAP Technology QNAP. An authorization issue vulnerability exists in QNAP VioStor that stems from improper authentication and could compromise system security...

CVE-2025-25010

Incorrect authorization in Kibana can lead to privilege escalation via the built-in reportinguser role which incorrectly has the ability to access all Kibana Spaces...

Linux Distros Unpatched Vulnerability : CVE-2024-48936

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under...

Microsoft PC Manager 授权问题漏洞

Microsoft PC Manager is a computer management software from Microsoft USA that allows one-click acceleration, system space management, pop-up window management, and comprehensive health check. Microsoft PC Manager suffers from an authorization issue vulnerability that stems from improper...

Apache Tomcat Authorization Problem Vulnerability (CNVD-2025-19105)

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server for the implementation of Servlet and JavaServer Page JSP support. Apache Tomcat suffers from an authorization problem vulnerability that stems from a rewrite valve session fixation flaw. An attack...

Apache Superset Authorization Problem Vulnerability (CNVD-2025-19101)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an authorization issue vulnerability that stems from improper access control on the /explore endpoint, which could be exploited by an attacker to obtain metadata abou...

Apache Superset 授权问题漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an authorization issue vulnerability that stems from improper access control on the /explore endpoint, which could be exploited by an attacker to obtain metadata abou...

WordPress plugin WordPress Event Manager, Event Calendar and Booking Plugin 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability in th...

PT-2025-33162 · WordPress · Thank You Page Customizer For Woocommerce – Increase Your Sales

Name of the Vulnerable Software and Affected Versions: VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales versions through 1.1.7 Description: A missing authorization issue exists in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales, allowing...

CVE-2025-8756

A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of the file /manage/ of the component com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor. The manipulation leads to improper...

CVE-2025-8839 jshERP Endpoint addUser improper authorization

A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may b...

SuiteCRM 授权问题漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. An authorization issue vulnerability exists in SuiteCRM version 7.14.6, which stems from allowing unauthorized downloads of files in the upload directory...

Microsoft Exchange Server 授权问题漏洞

Microsoft Exchange Server is a set of e-mail service programs from Microsoft. It provides email access, storage, forwarding, voicemail, email filtering and screening, and other features. An authorization issue vulnerability exists in Microsoft Exchange Server, which stems from a mixed deployment...

CVE-2025-41698 Draeger: ICMHelper is vulnerable to a privilege escalation due too missing authorization

A low privileged local attacker can interact with the affected service although user-interaction should not be allowed...

LibreChat 授权问题漏洞

LibreChat is an enhanced ChatGPT clone by Danny Avila Personal Developer. An authorization issue vulnerability exists in LibreChat versions 0.0.6 through 0.7.7-rc1, which stems from a test endpoint exposure that could lead to the disclosure of arbitrary user chat logs...

Cursor 授权问题漏洞

Cursor is an AI code editor from Cursor open source. An authorization issue vulnerability exists in Cursor versions prior to 1.3.9 that stems from allowing unapproved user writes to workspace files, which could lead to remote code execution...

PT-2025-31905 · Unknown · Atjiu Pybbs

Name of the Vulnerable Software and Affected Versions: atjiu pybbs versions up to 6.0.0 Description: A critical issue exists in the Email Verification Handler component, leading to improper authorization. The attack can be initiated remotely, and the exploit has been publicly disclosed...

CVE-2025-8435

A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin-control.php. The manipulation of the argument ID leads to missing authorization. The attack can be launched...

CVE-2025-8435 code-projects Online Movie Streaming admin-control.php authorization

A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin-control.php. The manipulation of the argument ID leads to missing authorization. The attack can be launched...

CVE-2025-8435 code-projects Online Movie Streaming admin-control.php authorization

A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin-control.php. The manipulation of the argument ID leads to missing authorization. The attack can be launched...