Lucene search
+L

78292 matches found

Cvelist
Cvelist
added 2026/08/24 7:03 p.m.5 views

CVE-2026-71508 Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourl...

7.1CVSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/24 7:00 p.m.5 views

CVE-2026-71505 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

7.1CVSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/24 6:31 p.m.3 views

EUVD-2026-65008

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backendconfig property in backend/src/Entity/Station.php is annotated with GROUPGENERAL, and PUT /api/station/stationid/profile/edit in...

8.7CVSS5.5AI score
SaveExploits0References6
EUVD
EUVD
added 2026/08/24 6:31 p.m.3 views

EUVD-2026-64992

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...

8.8CVSS5.6AI score
SaveExploits0References3
NVD
NVD
added 2026/08/24 4:17 p.m.2 views

CVE-2026-67204

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...

5.4CVSS
SaveExploits0References4
NVD
NVD
added 2026/08/24 2:17 p.m.4 views

CVE-2026-78372

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

9.2CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/24 2:16 p.m.4 views

EUVD-2026-64895

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export...

7.1CVSS6AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/24 2:04 p.m.7 views

CVE-2026-78387 RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

9.4CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/24 2:04 p.m.5 views

EUVD-2026-64890

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

9.4CVSS5.4AI score
SaveExploits0References1
NVD
NVD
added 2026/08/24 1:19 p.m.3 views

CVE-2026-78365

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

9.3CVSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/24 1:09 p.m.11 views

CVE-2026-78372 RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

9.2CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/24 1:03 p.m.5 views

EUVD-2026-64843

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/ endpoint permits selected internal databases to be exported without requiring authentication. While...

9.2CVSS5.7AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/24 1:03 p.m.13 views

CVE-2026-78370 RansomLook Unauthenticated Database Export Exposes Private Data

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/ endpoint permits selected internal databases to be exported without requiring authentication. While...

9.2CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/24 12:49 p.m.5 views

EUVD-2026-64839

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

9.3CVSS5.3AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/24 12:49 p.m.10 views

CVE-2026-78365 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

9.3CVSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.26 views

Bonita Web 2021.2 - Authentication/Authorization Bypass

Bonita Web 2021.2 contains an authentication/authorization bypass vulnerability caused by an overly broad exclude pattern in RestAPIAuthorizationFilter, allowing unauthenticated users to access privileged API endpoints by appending ;i18ntranslation or /../i18ntranslation/ to the URL. id:...

9.8CVSS8.7AI score0.56724EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.119 views

Modoboa < 2.1.0 - Improper Authorization

Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. id: CVE-2023-2227 info: name: Modoboa 2.1.0 - Improper Authorization author: ritikchaddha,princechaddha severity: critical description: | Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. impact:...

9.1CVSS8.5AI score0.44029EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.90 views

Lin CMS Spring Boot - Default JWT Token

An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application. id: CVE-2022-32430 info: name: Lin CMS Spring Boot - Default JWT Token author: DhiyaneshDK severity: high description: | An access control issue in Lin CM...

7.5CVSS7.4AI score0.04645EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.74 views

Hospital Management System 1.0 - SQL Injection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/user-login.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

9.8CVSS9.1AI score0.04917EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.55 views

QNAP HBS 3 - Broken Access Control

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 Hybrid Backup Sync. If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to...

10CVSS8.9AI score0.7825EPSS
SaveExploits0References4
Rows per page
Query Builder