CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862

The open-source human resources management solution Frappe HR is vulnerable to a missing authorization flaw (CWE-862) in its PWA API endpoints . Versions prior to 15.58.3 and 16.4.3 do not consistently authorize employee-specific PWA API requests, allowing an authenticated user to request and acc...

EUVD-2026-103171

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the...

CVE-2026-108373 ERPNext: Unauthorised access to financial data due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the...

CVE-2026-108373

The ERPNext Enterprise Resource Planning tool is vulnerable to unauthorized access to financial data in versions prior to 15.118.0 and 16.27.0 . The root cause is a missing authorization check within certain endpoints of the Sales Person-wise Transaction Summary report. Specifically, the system f...

infected-drones

Infected Drones Drone-to-Ground Control Station attack vectors, vulnerabilities & exploits Drone fleets today are one operator flying dozens or hundreds of drones from a single ground station. This makes the ground control station a valuable target for adversaries. It is where the pilot is usuall...

CVE-2026-108374 ERPNext: Unauthorised status modification due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

EUVD-2026-103170

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

CVE-2026-108374 ERPNext: Unauthorised status modification due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

CVE-2026-108374

The ERPNext enterprise resource planning tool is vulnerable to unauthorised status modification in versions prior to 15.121.0 and 16.34.0 . The root cause is a missing authorization check in certain endpoints used for status modification. A low-privileged authenticated user can bypass required wr...

CVE-2026-54597

CVE-2026-54597 - ITFlow Time-Based Blind SQL Injection Severity: High Advisory: GHSA-m63v-j7fw-hq2h Affected: ITFlow agent/ajax.php — expires parameter Fixed in: Commit 63d8691 Author: iltosec Summary A time-based blind SQL injection vulnerability in ITFlow's share link generation handler. The...

Prompt-Injection-in-the-Wild

Prompt Injection in the Wild A tracker of publicly reported prompt-injection techniques from roughly the last two years, maintained by Rachel James cybershujin. Each technique is broken down into the three elements of a prompt injection: 1. Delivery method — how the injected instructions reach th...

CVE-2021-42667

CVE-2021-42667 CVE-2021-42667 - SQL Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: An SQL Injection vulnerability exists in the Event management software version 2.3.0. An attacker can leverage the vulnerable "id" parameter in the...

severitas

🛡️ Severitas Framework Severitas is an authorized social-engineering awareness and simulation framework. It is structurally constrained to run exclusively inside isolated laboratory environments against synthetic identities. 💎 Features Severitas isolates assessment execution logically so that...

poc-graphql

Table Of Content Table Of Content Research on GraphQL Objective Labs Deploying on Docker Security weaknesses Authorization Issue Reco Injection Issue Reco Resource exhaustion Issue Reco Exposure of private data Issue Reco Exposure of technical information in case of unexpected error Issue Reco...

CVE-2026-87862

A flaw was found in curl. When importing HTTP Strict Transport Security HSTS cache records, loading a parent domain entry configured to include subdomains before a longer-lived subdomain entry silently drops the subdomain policy. Consequently, once the parent policy expires, curl fails to upgrade...

CVE-2026-111718

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orderby and groupby fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and...

CVE-2026-111713

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111707

99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values...