EUVD-2025-208174

Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal fl...

CVE-2021-22449

CVE-2021-22449 affects Elf-G10HN 1.0.0.608 and Huawei WATCH Kid (1.0.0.608) with a logic vulnerability allowing an unauthenticated attacker to perform operations that add friends without prompting. root cause: insufficient security design. Impact described as enabling friend-adding actions on tar...