CVE-2025-3964

A vulnerability, which was classified as problematic, was found in withstars Books-Management-System 1.0. Affected is an unknown function of the file /api/article/del of the component Article Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the delete API. An attacker can execute arbitrary JavaScript code by injecting malicious scripts into user inputs. This can lead to unauthorized actions such as stealing session cookies, redirecting to...

PT-2025-11237

Name of the Vulnerable Software and Affected Versions: The Resido - Real Estate WordPress Theme versions up to, and including, 3.6 Description: The issue is related to unauthorized access due to a missing capability check on the delete api key and save api key AJAX actions. This allows...

CVE-2024-55954

OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint "/api/orgid/users/emailid" allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the...

PT-2025-3162

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 0.14.1 Description A vulnerability in the user management endpoint /api/org id/users/email id allows an "Admin" role user to remove a "Root" user from the organization, violating the intended privilege hierarchy...

Privilege Escalation

github.com/usememos/memos is vulnerable to privilege escalation. An authenticated user is able to delete all notes of the whole application via the DELETE API...

CVE-2022-31884: Undefined Security Weakness

Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including high privilege and the Administrator users API Keys...