ScriptAndTools Online-Travling-System 安全漏洞

ScriptAndTools Online-Travling-System is an online traveling system from ScriptAndTools, Inc. A security vulnerability exists in ScriptAndTools Online-Travling-System version 1.0, which stems from improper access control in the /admin/addpackage.php file, which could lead to bypassing access...

CVE-2025-4036

A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/github/xxyopen/novel/controller/author/AuthorController.java of the component Chapter Handler. The manipulation leads to improper access...

CVE-2025-4036

A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/github/xxyopen/novel/controller/author/AuthorController.java of the component Chapter Handler. The manipulation leads to improper access...

CVE-2025-4036

CVE-2025-4036 affects Novel 201206030, version 3.5.0, specifically the updateBookChapter function in Chapter Handler (AuthorController.java). The root cause is improper access controls, enabling a remote attack. Public exploit disclosure is noted across multiple feeds. Some sources (e.g., PT-2025...

CVE-2025-42598

Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a language other than English. If a user is directed to place a crafted DLL file in a location of an attacker's choosing, the attacker may execute arbitrary cod...

novel 安全漏洞

novel is an open source novel system by xxyopen open source. A security vulnerability exists in Novel version 3.5.0, which stems from improper access control...

CVE-2025-3667

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3674

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The...

CVE-2025-3675

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been rated as critical. Affected by this issue is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been...

CVE-2025-3668

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been declared as critical. This vulnerability affects the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has...

Multiple vulnerabilities in Quick Agent

Overview Quick Agent provided by SIOS Technology, Inc. is a Windows application for the following Ricoh MFPs' multifunction printers scan solutions. Quick Scan Easy FAX Speedoc Smart eco FAX Quick Agent contains multiple vulnerabilities listed below. Path traversal vulnerability in the file uploa...

PT-2025-28380 · Unknown · Audio Service

Name of the Vulnerable Software and Affected Versions: LeAudioService versions prior to SMR Jul-2025 Release 1 Description: The issue is related to improper access control in LeAudioService, allowing local attackers to stop broadcasting Auracast. Recommendations: For versions prior to SMR Jul-202...

CVE-2024-30148 HCL Leap is affected by improper access control

Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to insufficient enforcement of MFA checks due to a failure to verify that the requesting user matches the target user ID when modifying MFA settings, allowing privilege escalation...

Unauthorized Access

github.com/mattermost/mattermost-server is vulnerable to Unauthorized Access. The vulnerability is due to improper access control due to a failure to enforce the "Allow Users to View Archived Channels" setting when fetching metadata from archived channels, which allows an attacker to access...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is due to improper enforcement of the 'Allow users to view/update archived channels' system setting, which allows authenticated users to access member information in archived channels even when the...

WordPress plugin Sirat 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin hashtagger 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2025-42605

CVE-2025-42605 affects Meon Bidding Solutions. Improper authorization controls on specific API endpoints used for initiation, modification, or cancellation allow an authenticated remote attacker to manipulate request body parameters and gain unauthorized access to other user accounts. Successful ...

simasehutner.adv.br Improper Access Control vulnerability OBB-4048318

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...