17812 matches found
CVE-2026-42317
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch...
CVE-2026-10860
A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as $validationError === null && POST || DELETE, meaning a DELETE request...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the project management API write paths due to missing authorization checks when handling PUT /api/projects/id and DELETE /api/projects requests. An attacker can modify or delete any project, including all...
CVE-2026-10860
In CVE-2026-10860, a logic error in the MISP CRUD component delete handler bypasses validation due to missing parentheses in the delete condition, allowing a DELETE request to proceed even when the delete validation callback rejects the operation. An authenticated attacker with access to an affec...
CVE-2026-10860
A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as $validationError === null && POST || DELETE, meaning a DELETE request...
CVE-2026-10860 MISP CRUDComponent delete validation bypass via operator precedence error
A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as $validationError === null && POST || DELETE, meaning a DELETE request...
EUVD-2026-34264
A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as $validationError === null && POST || DELETE, meaning a DELETE request...
CVE-2026-10860 MISP CRUDComponent delete validation bypass via operator precedence error
A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as $validationError === null && POST || DELETE, meaning a DELETE request...
CVE-2026-10860 MISP CRUDComponent delete validation bypass via operator precedence error
A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as $validationError === null && POST || DELETE, meaning a DELETE request...
PT-2026-46382
Unauthenticated Privilege Escalation in Support Ticket Management System = 1.9 versions...
PT-2026-46333
Unauthenticated Local File Inclusion in Iona = 1.0.8 versions...
PT-2026-46352
Unauthenticated Local File Inclusion in Mission = 1.22 versions...
PT-2026-46357
Unauthenticated Local File Inclusion in Quirky = 1.23 versions...
PT-2026-46370
Unauthenticated Local File Inclusion in Gunslinger = 1.7 versions...
PT-2026-46344
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCareer: from n/a through 7.3...
PT-2026-46361
Unauthenticated Local File Inclusion in Gamic = 1.15 versions...
PT-2026-46377
Unauthenticated Local File Inclusion in Etude = 1.6 versions...
PT-2026-46353
Unauthenticated Local File Inclusion in Preservation = 1.10 versions...