CVE-2026-100879

A security flaw exists in zhistaredu StarTraining up to version 3.8.1 . The vulnerability is located in the checkRoleAllowed function within the SysRoleServiceImpl.java file of the dataScope Endpoint component. This flaw leads to missing authorization , which may be triggered via a remote attack ...

EUVD-2026-88034

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

CVE-2026-100878

A vulnerability exists in zhistaredu StarTraining versions up to 3.8.1 within the authRole Endpoint . The flaw is located in the SysUser.isAdmin function inside the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java. By manipulating the userId/roleIds arguments, an attac...

CVE-2026-100878 zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds lea...

CVE-2026-100878 zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds lea...

EUVD-2026-88035

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds lea...

CVE-2026-101042 Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity

Parse Server is an open-source backend server. In versions = 9.0.0 = 8.0.2 8.6.91, the code-based authentication adapters GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo verify the client's authorization code with the external provider on signup and on...

CVE-2026-101042

The Parse Server backend server (versions >= 9.0.0 = 8.0.2

CVE-2026-96899 Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-96899 Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

EUVD-2026-87901

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-96899

The Optima Express IDX WordPress plugin (versions 8.6.0 - 8.7.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw occurs because the plugin fails to properly neutralise a script value submitted via a REST endpoint before storing it and subsequently echoing it into the document head ...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the download endpoint. An attacker can access restricted audio content by directly requesting media files using valid media identifiers. Remediation Upgrade azuracast/azuracast to version 0.23.8 or higher...

CVE-2026-100853

AzuraCast versions prior to 0.23.8 are vulnerable to an authorization bypass in the public On-Demand download endpoint. The root cause is a failure to verify playlist-level access controls , which allows unauthenticated users to download media files that were intended to be excluded from On-Deman...

CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...

CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...

CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...

PT-2026-99473

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description The public On-Demand download endpoint fails to verify playlist-level access controls. This allows unauthenticated users to bypass intended access restrictions by directly requesting media via the...

CVE-2026-100882: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php of the component Admin Settings Endpoint. Performing a manipulation of the argument general.settings.footer.labe...

CVE-2026-100878: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds lea...