130 matches found
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php-74-exposure-lab A reproducible lab for answering one ques...
CVE-2026-113600
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsControllerupdate and destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE...
CVE-2026-113600
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsControllerupdate and destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE...
CVE-2026-113600
Fat Free CRM before version 0.26.0 is vulnerable to an insecure direct object reference (IDOR) within the CommentsController . The root cause is the use of an unscoped Comment.find method in both the update and destroy actions without implementing proper authorization checks. This allows authenti...
CVE-2026-113600 Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsControllerupdate and destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE...
CVE-2026-113600 Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsControllerupdate and destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE...
CVE-2026-113600 Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsControllerupdate and destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE...
EUVD-2026-105166
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsControllerupdate and destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE...
PT-2026-118460
🚨 CVE-2026-113600 Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsControllerupdate and destroy use an unscoped Comment.find without authorization checks. Attackers can...
Fat Free CRM Authorization Issues Vulnerability
Versions of Fat Free CRM prior to 0.26.0 have a permission-related vulnerability. This vulnerability stems from the use of Comment.find with an unconstrained scope in CommentsControllerupdate and destroy, without proper authorization checks. Attackers can send PUT or DELETE requests to...
Fat-Free Factory’s fatfree-core authorization issue vulnerability
The Fat-Free Factory versions 3.9.2 and earlier contain security vulnerabilities. These vulnerabilities stem from improper certificate verification in the curl function within the web.php file of the HTTP Client component. This could allow remote attackers to bypass certificate verification...
GHSA-9PM8-VWC5-W2HM Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID
Impact Authenticated users can delete emails imported into the system assigned to another user; where the Email Dropbox is in use. Patches Fixed in v0.26.0 Workarounds Disable use of email dropbox...
Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID
Impact Authenticated users can delete emails imported into the system assigned to another user; where the Email Dropbox is in use. Patches Fixed in v0.26.0 Workarounds Disable use of email dropbox...
Authorization Bypass Through User-Controlled Key
Overview fatfreecrm is a customer relationship management platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the destroy action in app/controllers/emailscontroller.rb. An attacker can delete another user’s email record by sending...
EUVD-2019-0619
Malware in sbrugna...
EUVD-2022-2472
Malicious code in bioql PyPI...
EUVD-2022-3668
Malicious code in bioql PyPI...
EUVD-2022-3925
Malicious code in bioql PyPI...