CVE-2025-4065 ScriptAndTools Online-Travling-System addadvertisement.php access control

A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/addadvertisement.php. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been...

CVE-2025-4064

CVE-2025-4064 affects ScriptAndTools Online-Travling-System v1.0. The vulnerability resides in an unknown part of /admin/viewenquiry.php and exploits improper access controls. Reported as remotely initiable and public exploit disclosure exists. Multiple sources corroborate a critical issue affect...

Remote Code Execution (RCE)

moodle/moodle is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper access control in the Moodle LMS Dropbox repository, allows teachers and managers, by default, to have access to the affected functionality, creating an opportunity for remote code execution...

ScriptAndTools Online-Travling-System 安全漏洞

ScriptAndTools Online-Travling-System is an online travel system from ScriptAndTools, Inc. A security vulnerability exists in ScriptAndTools Online-Travling-System version 1.0, which stems from improper access control in the /admin/viewenquiry.php file, which could lead to bypassing access contro...

ScriptAndTools Online-Travling-System 安全漏洞

ScriptAndTools Online-Travling-System is an online traveling system from ScriptAndTools, Inc. A security vulnerability exists in ScriptAndTools Online-Travling-System version 1.0, which stems from improper access control in the /admin/addpackage.php file, which could lead to bypassing access...

CVE-2025-4036

A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/github/xxyopen/novel/controller/author/AuthorController.java of the component Chapter Handler. The manipulation leads to improper access...

CVE-2025-4036

A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/github/xxyopen/novel/controller/author/AuthorController.java of the component Chapter Handler. The manipulation leads to improper access...

CVE-2025-4036

CVE-2025-4036 affects Novel 201206030, version 3.5.0, specifically the updateBookChapter function in Chapter Handler (AuthorController.java). The root cause is improper access controls, enabling a remote attack. Public exploit disclosure is noted across multiple feeds. Some sources (e.g., PT-2025...

CVE-2025-42598

Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a language other than English. If a user is directed to place a crafted DLL file in a location of an attacker's choosing, the attacker may execute arbitrary cod...

novel 安全漏洞

novel is an open source novel system by xxyopen open source. A security vulnerability exists in Novel version 3.5.0, which stems from improper access control...

CVE-2025-3667

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3674

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The...

CVE-2025-3675

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been rated as critical. Affected by this issue is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been...

CVE-2025-3668

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been declared as critical. This vulnerability affects the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has...

Multiple vulnerabilities in Quick Agent

Overview Quick Agent provided by SIOS Technology, Inc. is a Windows application for the following Ricoh MFPs' multifunction printers scan solutions. Quick Scan Easy FAX Speedoc Smart eco FAX Quick Agent contains multiple vulnerabilities listed below. Path traversal vulnerability in the file uploa...

PT-2025-28380 · Unknown · Audio Service

Name of the Vulnerable Software and Affected Versions: LeAudioService versions prior to SMR Jul-2025 Release 1 Description: The issue is related to improper access control in LeAudioService, allowing local attackers to stop broadcasting Auracast. Recommendations: For versions prior to SMR Jul-202...

CVE-2024-30148 HCL Leap is affected by improper access control

Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to insufficient enforcement of MFA checks due to a failure to verify that the requesting user matches the target user ID when modifying MFA settings, allowing privilege escalation...

Unauthorized Access

github.com/mattermost/mattermost-server is vulnerable to Unauthorized Access. The vulnerability is due to improper access control due to a failure to enforce the "Allow Users to View Archived Channels" setting when fetching metadata from archived channels, which allows an attacker to access...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is due to improper enforcement of the 'Allow users to view/update archived channels' system setting, which allows authenticated users to access member information in archived channels even when the...