Improper Authorization

github.com/mattermost/mattermost-server is vulnerable to Improper Authorization. The vulnerability is due to failure to verify whether a user has permission to join a Mattermost team when processing the original invite token, which allows an attacker to manipulate the RelayState parameter and joi...

Improper Authorization

Overview potsky/pimp-my-log is a Log viewer for your web server. Affected versions of this package are vulnerable to Improper Authorization via the Account Creation Endpoint. An attacker can gain unauthorized administrative access and execute arbitrary JavaScript by exploiting the unsanitized...

Security Bulletin: Vulnerability in spring-core affects IBM Netezza Appliance

Summary The spring-core package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2025-41249 Vulnerability Details CVEID:CVE-2025-41249 DESCRIPTION: The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the REST API. An attacker can access user notification settings or enumerate all users by sending crafted API requests. Remediation Upgrade Weblate to version 5.15 or higher. References - GitHub Commit - GitHu...

allauth-django 安全漏洞

allauth-django is an authentication application from allauth open source. A security vulnerability exists in allauth-django versions prior to 65.13.0 that stems from Okta and NetIQ's use of preferredusername as an identifier for third-party provider accounts, which could lead to improper...

WordPress plugin Royal Addons for Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin... A security...

Improper Authorization

magento is vulnerable to Improper Authorization. The vulnerability is due to insufficient enforcement of security controls, which allows an attacker to bypass protections and gain unauthorized access without user interactio...

Improper Authorization

getgrav/grav is vulnerable to Improper Authorization. The vulnerability is due to insufficient authorization checks when modifying critical form fields via POST requests, which allows an attacker to alter YAML frontmatter including form processing logic and potentially exploit unintended actions...

CVE-2025-61950

In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. With some crafted request, a logged-in user may alter the memo field. The affected products and versions are GroupSession Free edition prior to ver5.3.0,...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the EOTS manager endpoints when these endpoints are accessible to the public without HMAC protection. An attacker can trigger unauthorized actions by sending crafted requests to the exposed RPC endpoints...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the EOTS manager endpoints when these endpoints are accessible to the public without HMAC protection. An attacker can trigger unauthorized actions by sending crafted requests to the exposed RPC endpoints...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the EOTS manager endpoints when these endpoints are accessible to the public without HMAC protection. An attacker can trigger unauthorized actions by sending crafted requests to the exposed RPC endpoints...

CVE-2025-13506 Improper Authorization in Nebim Neyir's Nebim V3 ERP

Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allows Expanding Control over the Operating System from the Database. This issue affects Nebim V3 ERP: from 2.0.59 before 3.0.1...

CVE-2025-13506 Improper Authorization in Nebim Neyir's Nebim V3 ERP

Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allows Expanding Control over the Operating System from the Database. This issue affects Nebim V3 ERP: from 2.0.59 before 3.0.1...

CVE-2025-13506

Nebim V3 ERP (Nebim Neyir Computer Industry and Services Inc.) is affected by CVE-2025-13506 for versions 2.0.59 up to, but not including, 3.0.1. The issue is described as an Execution with Unnecessary Privileges vulnerability that enables expanding control over the operating system from the data...

Improper Authorization org.springframework:spring-core Dependency in Bitbucket Data Center and Server

This High severity Improper Authorization vulnerability was introduced in version 8.19.0 and 9.4.0 of Bitbucket Data Center and Server. This Improper Authorization vulnerability, with a CVSS Score of 7.5, allows an attacker to potentially perform actions to circumvent authorization checks, which...

Japan Total System多款产品 安全漏洞

Japan Total System GroupSession Free edition, among others, is an enterprise collaboration software from Japan Total System. A security vulnerability exists in various Japan Total System products, which stems from an improper authorization check that could result in modification of memo fields. T...

EUVD-2025-202594

Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized...

Exploit for Improper Authorization in Vercel Next.Js

Next.js RCE Scanner Scanner for CVE-2025-29927 - Next.js/...

CVE-2025-1161 Improper Authorization in Nomysoft Informatics' Nomysem

Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc. Nomysem allows Privilege Escalation. This issue affects Nomysem: through May 2025...