EUVD-2025-31142

Malicious code in bioql PyPI...

CVE-2025-29155

An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint...

CVE-2025-29155

An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint...

CVE-2025-29155

An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint...

Swagger Petstore Sample 安全漏洞

Swagger Petstore Sample is a sample petstore system in the Swagger open source. A security vulnerability exists in Swagger Petstore Sample version 1.0.7 that stems from the DELETE endpoint not properly validating input, which could lead to remote code execution...

PT-2025-39433

Name of the Vulnerable Software and Affected Versions petstore version 1.0.7 Description An issue allows a remote attacker to execute arbitrary code via the DELETE endpoint. The affected API endpoint is '/DELETE'. Recommendations At the moment, there is no information about a newer version that...

CVE-2025-29155

An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint...

CVE-2025-29155: Improper Neutralization of Special Elements used in a Command

An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint...

CVE-2025-29155

An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint...

CVE-2025-29155

The petstore sample system version 1.0.7 is vulnerable to remote code execution due to an issue in the DELETE endpoint (specifically the '/DELETE' endpoint) which fails to properly validate input. Exploitation details or specific exploit links are not provided in the documentation. There is curre...

PT-2025-38082

Name of the Vulnerable Software and Affected Versions: Campcodes Grocery Sales and Inventory System version 1.0 Description: A SQL injection issue exists in Campcodes Grocery Sales and Inventory System 1.0. Manipulation of the ID argument in the /ajax.php?action=delete receiving API endpoint can...

Improper Access Control

unopim/unopim is vulnerable to Improper Access Control. The vulnerability is due to insufficient privilege enforcement on the mass-delete endpoint, which allows an attacker without "Delete" permissions to bypass restrictions and delete products...

Mozilla: User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon

A vulnerability was discovered in the Mozilla Pontoon application that allowed users to delete other users' personal access tokens at the /delete-token/tokenid/ endpoint without proper permission checks. The vulnerability was caused by the absence of user permission verification in the deletetoke...

PT-2025-35325

Name of the Vulnerable Software and Affected Versions: Campcodes Online Loan Management System version 1.0 Description: A weakness exists in Campcodes Online Loan Management System that allows for SQL injection. The issue is located in an unknown function within the /ajax.php?action=delete borrow...

CVE-2025-54598

The Bevy Event service (used for eBay Seller Events and other activities) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in versions through 2025-07-22 . An attacker can exploit this vulnerability to delete all notifications by targeting the /notifications/delete/ URI. To mitigate this...

PT-2025-34886 · Ebay · Bevy Event Service

Name of the Vulnerable Software and Affected Versions: The Bevy Event service versions through 2025-07-22 Description: The Bevy Event service, used for eBay Seller Events and other activities, is susceptible to a Cross-Site Request Forgery CSRF issue. This flaw allows an attacker to delete all...

UnoPim has Broken Access Control

Summary In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint expected behavior, but can still delete products via the mass-delete endpoint, even when the request...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the mass-delete endpoint. An attacker can delete products without proper authorization by sending a POST request to the bulk deletion endpoint, even when only a single product ID is provided. Remediation Upgrad...

CVE-2025-55741

UnoPim is a Laravel-based open-source PIM. In versions

CVE-2025-55741 unopim/unopim allows unauthorized product deletion via mass-delete endpoint

UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intend...