18572 matches found
PT-2025-48558
Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27 Description Grav CMS is susceptible to a Server-Side Template Injection SSTI issue. An authenticated user with editor permissions can execute arbitrary code on the remote server, bypassing the security...
CVE-2025-65840
PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery CSRF in the CkEditorAdminController...
PT-2025-48560
Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27 Description Grav is a file-based Web platform. Improper authorization checks when modifying critical fields on a POST request to the /admin/pages/page name endpoint allow an editor with limited permissions ...
CVE-2025-66301: Improper Authorization
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/pagename, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through...
The vulnerability of the Cisco Unified Contact Center Express (Unified CCX) Editor software lies in the lack of authentication for a critical function. This allows attackers to circumvent existing security restrictions and increase their privileges.
The vulnerability of the Cisco Unified Contact Center Express Unified CCX Editor software lies in the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker to bypass existing security restrictions and gain increased privileges...
ALSA-2025:22417 Important: gimp:2.8 security update
The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: GIMP DCM...
CVE-2025-12756: Incorrect Authorization
Mattermost versions 11.0.x = 11.0.2, 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users...
PT-2025-48554
Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27 Description Grav is a file-based Web platform with a Server-Side Template Injection SSTI issue. Authenticated attackers with editor permissions can execute arbitrary commands on the server. Under certain...
📄 LG Simple Editor 3.21.0 Remote Command Injection
LG Simple Editor version 3.21.0 proof of concept remote command injection exploit. ============================================================================================================================================= | Title : LG Simple Editor 3.21.0 PHP Code Injection Vulnerability | |...
CVE-2025-65840
PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery CSRF in the CkEditorAdminController...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the HTML editor route. An attacker can gain unauthorized access to sensitive information and user metadata by sending crafted requests to the affected endpoint. Remediation Upgrade trytond to version 6.0.70,...
trytond does not enforce access rights for the route of the HTML editor.
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...
GHSA-P3P5-XRMV-4J6X trytond does not enforce access rights for the route of the HTML editor.
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...
EUVD-2025-199918
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...
CVE-2025-66423
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...
DEBIAN-CVE-2025-66423
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...
CVE-2025-66423
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...
UBUNTU-CVE-2025-66423
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...
CVE-2025-66423
CVE-2025-66423 affects Tryton’s Trytond server, specifically 6.0 before 7.6.11. The root cause is that the HTML editor route did not enforce access rights, allowing unauthorized access as described in multiple sources. The vulnerability is fixed in versions 7.6.11, 7.4.21, 7.0.40, and 6.0.70. Acc...