CVE-2025-32360

In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information...

inDrive: Rider can forcefully get passenger's order accepted resulting in multiple impacts including PII reveal and more mentioned in the report.

A vulnerability was found in the customer order flow that allowed a driver to forcefully accept an order on behalf of a passenger, bypassing the normal negotiation process. This allowed the driver to set the ride price without following the built-in fare calculation algorithm...

CVE-2019-16403

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values such as address, review, orders, etc. can also be manipulated by other customers...