113514 matches found
PT-2026-109932
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists where the permission check in the queryById function is commented out in the source code. This allows any authenticated user to access the '/airag/app/queryById' endpoi...
PT-2026-109892
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysDepartPermissionController delete handler. Low-privileged authenticated users can delete department permission bindings by obtaining row identifiers from an...
PT-2026-109927
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the AiragPromptsController. This issue allows any authenticated user to delete AI prompt templates. An attacker with low privileges can...
PT-2026-109922
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw allows authenticated users to transfer tenant ownership. By sending a request to the POST '/sys/tenant/changeOwenUserTenant' endpoint, low-privileged attackers can use the...
PT-2026-109937
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can download announcement attachments due to missing authorization in the SysAnnouncementController downLoadFiles handler. By providing a known announcement id, a...
PT-2026-109917
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysTenantController within the GET '/sys/tenant/getTenantPackApplyUsers' endpoint. This issue allows any authenticated user to access tenant administrator...
cve-2025-29927
CVE-2025-29927 1. go to /api/flag 2. add x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware as header 3. see response...
cve-2026-29204-whmcs-clientarea-addonid
CVE-2026-29204 — WHMCS client area addon guard Unofficial community notes for CVE-2026-29204: on clientarea.php?action=productdetails, a logged-in client can supply a foreign addonId with modop=custom and reach module context that does not belong to the session. Upgrade first. Apply a...
auto-repeater
AutoRepeater: Ripetizione automatica delle richieste HTTP con Burp Suite tl;dr All'interno di Extender importa AutoRepeater.jar Alcune brevi istruzioni AutoRepeater reinvierà solo le richieste modificate da una sostituzione definita. Quando AutoRepeater riceve una richiesta che corrisponde alle...
CVE-2026-107851
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...
CVE-2024-11848
CVE-2024-11848 NitroPack = 1.17.0 - Missing Authorization to Authenticated Subscriber+ Limited Options Update Description The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropackdismissnoticeforever' AJAX action in a...
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...
EUVD-2026-78651
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project...
EUVD-2026-78654
Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts...
EUVD-2026-51992
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide BOLA...
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...
GHSA-V3P6-34MC-HJ7V Vikunja: Scoped API token can mint unrestricted OAuth session credentials
Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...
CVE-2026-107851
The Contao Open Source CMS (versions 5.7.0 through 5.7.12) contains an improper access control vulnerability in the TableAccessVoter::hasAccessToModule() function located in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php. The root cause is that the voter caches authorization de...
