62260 matches found
CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,...
CVE-2026-109645
Frappe ERPNext versions prior to 15.119.0 and 16.x before 16.31.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper permission checks, allowing authenticated attackers with low privileges to bypass role-based access restrictions. Exploiting this vu...
CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,...
CVE-2026-109641
Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are susceptible to a missing authorization vulnerability (CWE-862). Specific endpoints fail to enforce proper authorization checks, allowing unauthenticated remote attackers to call these endpoints to create records and enumerate ava...
CVE-2026-109641 Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator h...
CVE-2026-109635 Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints
Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create...
CVE-2026-109635
Frappe ERPNext versions before 15.105.0 and 16.x before 16.15.0 are vulnerable to a missing authorization flaw (CWE-862). Certain document creation endpoints fail to verify if a requesting portal user belongs to the target party. This allows authenticated portal users to create documents on behal...
CVE-2026-109617
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are affected by a missing authorization vulnerability (CWE-862) in certain endpoints. The root cause is a failure to enforce proper authorization checks during document creation. This allows authenticated low-privileged users to bypa...
CVE-2026-109617 Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against...
CVE-2026-109617 Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against...
CVE-2026-109615 Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond...
CVE-2026-109615
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper permission checks during document creation, allowing authenticated low-privileged users to create documents against records outside th...
CVE-2026-109615 Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond...
CVE-2026-54459
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...
CVE-2021-4034-touch
CVE-2021-4034-touch touch creates file...
CVE-2020-6287_SAP-NetWeaver-bypass-auth
CVE-2020-6287SAP-NetWeaver-bypass-auth Automated Exploit for CVE-2020-6287 CVE-2020-6287: SAP NetWeaver AS JAVA LM Configuration Wizard, versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks...
harbor-give-me-admin
Harbor Admin Account Creation Vulnerability Detection Tool 0x00 Overview In 201909, Harbor disclosed a vulnerability that allows adding an administrator through the registration function. By using the registration API /api/users and crafting a POST parameter "hasadminrole": true, an administrator...
CVE-2026-54459
The web-based file manager FileRise is vulnerable to Cross-Site Request Forgery (CSRF) in versions prior to 3.14.0 . The application fails to enforce the X-CSRF-Token header for the POST endpoints /api/file/createFile.php and /api/file/createShareLink.php. This allows an attacker to potentially f...
CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...
CVE-2026-20253
π¨ CVE-2026-20253 - Critical Splunk Enterprise Unauthenticated File Creation Vulnerability Unauthenticated arbitrary file creation and truncation vulnerability affecting Splunk Enterprise and Splunk Cloud Platform. π Executive Summary CVE-2026-20253 is a critical vulnerability in Splunk Enterprise...