CVE-2025-4316

Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user interface actions. This issue affects Devolutions Server versions from 2025.1.3.0 through 2025.1.6.0, and all versions up...

CVE-2025-4269

CVE-2025-4269 affects TOTOLINK A720R 4.1.5cu.374, specifically the Log Handler’s file /cgi-bin/cstecgi.cgi. Manipulating the topicurl parameter with input values like clearDiagnosisLog/clearSyslog/clearTracerouteLog results in improper access controls, potentially enabling remote exploitation. Mu...

Shiro-Action 安全漏洞

Shiro-Action is a Shiro-based permission management system by zhao jun individual developer. A security vulnerability exists in Shiro-Action v0.6, which stems from improper access control of the component /user/list, which could lead to access to sensitive information...

production_ssm 安全漏洞

productionssm is an SSM Spring+SpringMVC+Mybatis + jQuery EasyUI developed ERP system by MegaGao Individual Developer. A security vulnerability exists in productionssm version v0.0.1, which stems from improper access control of the component /user/list, which could lead to access to sensitive...

yaoqishan 安全漏洞

yaoqishan DemonQishan is a video management system for Kobe Personal Developers. A security vulnerability exists in yaoqishan version v0.0.1, which stems from improper access control of the /admin/ API and may result in gaining administrator privileges...

Hope-Boot 安全漏洞

Hope-Boot is a modern scaffolding project by the individual developer java-aodeng. A security vulnerability exists in Hope-Boot v1.0.0, which stems from improper access control in the component /user/edit/ and could lead to bypassing authentication...

jeeweb-mybatis-springboot 安全漏洞

jeeweb-mybatis-springboot is a Java web distributed development system by huangjian888 individual developer. A security vulnerability exists in jeeweb-mybatis-springboot v0.0.1, which stems from improper access control of the component /admin/sys/datasource/ajaxList, which could result in access ...

xinguan 安全漏洞

xinguan is a new crown material management system by zykzhangyukang Individual Developer. A security vulnerability exists in xinguan version v0.0.1, which stems from improper access control of the /system/user/findUserList API, which could lead to access to sensitive information...

kob 安全漏洞

kob is an open source centralized job scheduling system from Ke Technologies that defines a task scheduling model and enables unified management and monitoring of task scheduling. A security vulnerability exists in kob version v1.0.0, which stems from improper access control of the doFilter...

One 安全漏洞

One is a front-end and back-end separated backend management system based on Spring Boot and Vue2 developed by lcw2004 individual developer. A security vulnerability exists in One v1.0, which stems from improper access control of component/api/user/manager, which may result in accessing sensitive...

Security Bulletin: Vulnerability in Flask-Cors affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-6221].

Summary The FlaskCors package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-6221. Vulnerability Details CVEID:CVE-2024-6221 DESCRIPTION: A vulnerability in corydolphin/flask-cors version 4.0.1 allows the...

CVE-2025-4118

A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the component Product History Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. It is possible to initiate the...

CVE-2025-4064

A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/viewenquiry.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-46631

Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the router's OS by sending a /goform/telnet web request...

CVE-2024-30146

Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem...

CVE-2024-30146 HCL Domino Leap is affected by improper access control

Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem...

CVE-2024-30146 HCL Domino Leap is affected by improper access control

Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem...

CVE-2025-4036

A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/github/xxyopen/novel/controller/author/AuthorController.java of the component Chapter Handler. The manipulation leads to improper access...

CVE-2025-4119

A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Product Statistics Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. The attack can be...

CVE-2025-4118

A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the component Product History Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. It is possible to initiate the...