CVE-2025-26660

SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to...

CVE-2025-26660 Broken Access Control in SAP Fiori apps (Posting Library)

SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to...

CVE-2025-27893

Archer Platform 6–6.14.00202.10024 is affected by CVE-2025-27893. An authenticated user with record-creation privileges can intercept and modify a Copy request to GenericContent/Record.aspx?id=, manipulating immutable fields (e.g., creation date). However, according to sources, when switching to ...

SAP Fiori security vulnerabilities

SAP Fiori, a user experience UX design system for SAP applications from SAP, Germany, provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, providing a consistent, innovative experience for creators and users. A security vulnerabili...

CVE-2025-27893

In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request via a GenericContent/Record.aspx?id= URI. NOTE: the Supplier analyzed the reported...

CVE-2025-27893

In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request via a GenericContent/Record.aspx?id= URI. NOTE: the Supplier analyzed the reported...

PT-2025-10720 · Rsa · Archer Platform

Name of the Vulnerable Software and Affected Versions: Archer Platform versions 6 through 6.14.00202.10024 Description: The issue allows an authenticated user with record creation privileges to manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request vi...

Why The Modern Google Workspace Needs Unified Security

The Need For Unified Security Google Workspace is where teams collaborate, share ideas, and get work done. But while it makes work easier, it also creates new security challenges. Cybercriminals are constantly evolving, finding ways to exploit misconfigurations, steal sensitive data, and hijack...

Adobe Commerce B2B Authentication Bypass

The vulnerability of the software platform for developing and managing Adobe Commerce B2B is related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions remotely...

CVE-2025-2089

A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of the file /personal/updateInfo of the component com.siro.mall.controller.mall.UserController. The manipulation of the argument userId leads ...

CVE-2025-2090

A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/add-subadmin.php of the component Sub Admin Handler. The manipulation leads to improper access controls. The attack may be...

CVE-2025-2121

A vulnerability classified as critical has been found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected is an unknown function of the component File Storage. The manipulation leads to improper access controls. The attack can only be done within the local network. The exploit has been...

CVE-2025-2121 Thinkware Car Dashcam F800 Pro File Storage access control

A vulnerability classified as critical has been found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected is an unknown function of the component File Storage. The manipulation leads to improper access controls. The attack can only be done within the local network. The exploit has been...

CVE-2025-2121

CVE-2025-2121 affects Thinkware Car Dashcam F800 Pro up to 20250226. The vulnerability resides in the File Storage component, with an unknown function enabling improper access controls exploitable from the local network. The exploit has been publicly disclosed and the vendor has not responded. A ...

PT-2025-10449 · Thinkware · Thinkware Car Dashcam F800 Pro

Name of the Vulnerable Software and Affected Versions: Thinkware Car Dashcam F800 Pro versions up to 20250226 Description: A critical vulnerability has been found in the File Storage component of the Thinkware Car Dashcam F800 Pro, affecting an unknown function. The manipulation leads to improper...

Mozilla: [Privilege Escalation] User can Pin|Unpin Any Comment on Any Project or Locale

A vulnerability was discovered in the Pontoon application where any user could pin or unpin comments on any project or locale, despite lacking the necessary privileges. This was possible due to the lack of proper access controls in the backend code handling the pin and unpin functionality...

CVE-2025-2090

A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/add-subadmin.php of the component Sub Admin Handler. The manipulation leads to improper access controls. The attack may be...

CVE-2025-2090

CVE-2025-2090 affects PHPGurukul Pre-School Enrollment System 1.0, specifically the Sub Admin Handler component and its /admin/add-subadmin.php functionality. The issue is improper access controls in that file, enabling potential unauthorized actions. Multiple connected sources (NVD/NVD-derived f...

CVE-2025-2089 StarSea99 starsea-mall com.siro.mall.controller.mall.UserController updateInfo updateUserInfo access control

A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of the file /personal/updateInfo of the component com.siro.mall.controller.mall.UserController. The manipulation of the argument userId leads ...

PT-2025-10092

Name of the Vulnerable Software and Affected Versions PHPGurukul Pre-School Enrollment System version 1.0 Description A critical issue affects some unknown functionality of the file /admin/add-subadmin.php of the component Sub Admin Handler, leading to improper access controls. The attack may be...