CVE-2026-90518 PHPGurukul Bank Locker Management System sidebar.php access control

A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation of the argument UserType results in improper access controls. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-90507

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

EUVD-2026-76980

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

CVE-2026-90507

CVE-2026-90507 affects the vvbbnn00 WARP-Clash-API (up to commit c7bf236), specifically the get_surge_subscription function in services/subscription.py (Subscription Handler component). Improper manipulation of the key argument leads to improper access control , exploitable remotely without authe...

CVE-2026-90507 vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

CVE-2026-90507 vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

CVE-2026-90493

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. Internet...

CVE-2026-90493

Tonec Internet Download Manager (up to 6.42 Build 63, Windows) contains an improper access control vulnerability in its kernel driver (idmwfp.sys). A local attacker with low privileges can exploit this to gain system-level access , as indicated by the changed scope and high impact across confiden...

EUVD-2026-76938

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. The exploit ...

CVE-2026-90493 Tonec Internet Download Manager Kernel Driver idmwfp.sys access control

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. Internet...

CVE-2026-90507: Improper Access Control

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

PT-2026-90823

Name of the Vulnerable Software and Affected Versions vvbbnn00 WARP-Clash-API versions up to c7bf2360073959861219b422e51ae86411051b46 Description Improper access controls exist in the Subscription Handler component. A remote attacker can manipulate the key argument within the get surge subscripti...

PT-2026-90783

Name of the Vulnerable Software and Affected Versions Tonec Internet Download Manager versions prior to 6.42 Build 64 Description An improper access control issue exists in the idmwfp.sys kernel driver of Tonec Internet Download Manager on Windows. The driver exposes the .IDMWFP device interface ...

PT-2026-90852

Name of the Vulnerable Software and Affected Versions PHPGurukul Bank Locker Management System version 1.0 Description An improper access control issue exists in the sidebar.php file. A remote attacker can manipulate the UserType argument to bypass security restrictions and gain unauthorized...

PT-2026-90870

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate t...

CVE-2026-90565: Improper Access Control

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate t...

CVE-2026-90518: Improper Access Control

A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation of the argument UserType results in improper access controls. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-90493: Improper Access Control

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. Internet...

Exploit for Improper Access Control in Ollyo Helix3

CVE-2026-49049 This repository contains a Python-based scanne...

CVE-2026-87892: Improper Access Control

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...