3445 matches found
EUVD-2025-36548
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...
CVE-2025-60800
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...
CVE-2025-60800
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...
PT-2025-44195
Name of the Vulnerable Software and Affected Versions jshERP versions prior to commit 90c411a Description An access control issue exists in the /jshERP-boot/user/info interface of jshERP. An attacker can obtain sensitive information by sending a specially crafted GET request to this interface. Th...
CVE-2025-60800
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...
CVE-2025-60800
CVE-2025-60800 affects jshERP, specifically the /jshERP-boot/user/info interface up to commit 90c411a. The root cause is improper access control, allowing an unauthenticated, crafted GET request to disclose sensitive information. Impact per sources: Confidentiality high; no integrity or availabil...
CVE-2025-60800
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...
Exploit for Improper Input Validation in Atlassian Confluence_Data_Center
LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0...
EUVD-2025-34263
A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...
CVE-2025-60535
A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...
CVE-2025-60535
A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...
CVE-2025-41706
The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality...
CVE-2025-41706
CVE-2025-41706 affects the Phoenix Contact webserver used in the QUINT4-UPS/24DC/24DC/10/EIP family. The issue is a denial-of-service condition that an unauthenticated remote attacker can trigger by sending a specially crafted GET request with an over-long Content-Length header. The vulnerability...
EUVD-2025-34148
The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality...
CVE-2025-60535
Wallos v4.1.1 contains a CSRF in the component /endpoints/currency/currency that could allow an attacker to perform arbitrary operations via a crafted GET request. The CVE-2025-60535 entry consistently describes this CSRF as the underlying issue; Red Hat and ENISA/EUVD mirrors also reference the ...
CVE-2025-60535
A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...
CVE-2025-11166
The WP Go Maps formerly WP Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery CSRF in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation, and having...
Checkmk 安全漏洞
Checkmk is an IT monitoring platform from Checkmk, Inc. A security vulnerability exists in Checkmk versions prior to 2.4.0p13, prior to 2.3.0p38, prior to 2.2.0p46, and 2.1.0, which stems from the possible use of sensitive information in a GET request, which could result in sensitive form data...
CVE-2025-56551
An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-controlled content via supplying a crafted GET request...