13683 matches found
Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...
CVE-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...
CVE-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...
CVE-2026-72555 Peppermint Lab Peppermint - Broken Access Control
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.rolesactive flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass...
CVE-2026-34191
A flaw was found in Apache Portable Runtime Utility. This vulnerability, known as SQL Injection, occurs in the aprdbdoracle provider. A remote attacker could exploit this by injecting malicious SQL commands, potentially leading to unauthorized access, modification, or deletion of data within the...
PT-2026-70033
Name of the Vulnerable Software and Affected Versions SAP ABAP Development Tools affected versions not specified Description SAP ABAP Development Tools fails to perform required authorization checks for specific functionality. This allows an attacker with low privileges to execute unauthorized...
CVE-2026-72546: Authorization Bypass Through User-Controlled Key
An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...
CVE-2026-18712: Incorrect Authorization
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...
EUVD-2026-55832
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the mergeaccount, pausejobfordoc, triggerjobfordoc, changereleasedate, and updatecostcenter functions across erpnext/accounts/doctype/account/account.py,...
CVE-2026-72910 ERPNext: Unauthorised modification of master data due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the mergeaccount, pausejobfordoc, triggerjobfordoc, changereleasedate, and updatecostcenter functions across erpnext/accounts/doctype/account/account.py,...
CVE-2026-72910 ERPNext: Unauthorised modification of master data due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the mergeaccount, pausejobfordoc, triggerjobfordoc, changereleasedate, and updatecostcenter functions across erpnext/accounts/doctype/account/account.py,...
CVE-2026-58041
A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application. Mitigation Applicatio...
CVE-2026-15238
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...
CVE-2026-14211 Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...
CVE-2026-14211
The Booking for Appointments and Events Calendar (Amelia Pro) WordPress plugin before version 9.7 is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify that an authenticated employee (provider) is authorized to access a specific customer's record. An ...
CVE-2026-14211 Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...
CVE-2026-15238
The MotoPress Hotel Booking (and Hotel Booking Lite ) WordPress plugin, in versions before 6.2.3 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to verify record ownership when updating customer records, which allows any authenticated user with a low-privileged ...
CVE-2026-15238
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...
CVE-2026-15238 Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...