34242 matches found
Viafirma Inbox 安全漏洞
Viafirma Inbox is an electronic signature inbox from the Spanish company Viafirma. A security vulnerability exists in Viafirma Inbox version 4.5.13, which stems from the presence of an insecure direct object reference that could cause any authenticated but unprivileged user to list all users,...
cpp-httplib 安全漏洞
cpp-httplib is an HTTP/HTTPS server and client library written in C++ by the individual developer yhirose. A security vulnerability exists in cpp-httplib versions prior to 0.30.1, which stems from insecure handling of compressed HTTP request bodies and could lead to a denial-of-service attack...
CVE-2025-67813
Quest KACE Desktop Authority versions through 11.3.1 are affected by a vulnerability involving insecure permissions on Named Pipes used for inter-process communication. Due to these improper default permissions, an authenticated domain user can access or manipulate the pipe, specifically the Scri...
CVE-2025-67813
Quest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communication...
CVE-2025-13457
The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the gettokenbyid function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Squa...
CVE-2025-13457
CVE-2025-13457 affects the WooCommerce Square plugin for WordPress (versions up to 5.1.1). The vulnerability is an Insecure Direct Object Reference in the get_token_by_id function due to missing validation on a user-controlled key, enabling unauthenticated attackers to exfiltrate arbitrary Square...
EUVD-2026-1860
The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the gettokenbyid function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Squa...
CVE-2026-22589 Spree API has Unauthenticated IDOR - Guest Address
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference IDOR vulnerability was identified that allows an unauthenticated attacker to access guest address information without...
WordPress plugin WooCommerce Square 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
PT-2026-2225
Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 16.6.3 Description OpenProject is a web-based project management software. Versions prior to 16.6.3 allowed users with the ‘View Meetings’ permission on any project to access meeting details from projects they did...
react-router 跨站脚本漏洞
react-router is a Remix open source declarative routing for React. A cross-site scripting vulnerability exists in React Router version 7.11.0 and earlier, which stems from the fact that an open navigation redirect may lead to an insecure URL, which could result in accidental client-side execution...
Fickling 代码问题漏洞
Fickling is an open source decompiler and static analyzer for Python by Trail of Bits. A code issue vulnerability exists in Fickling version 0.1.6 and earlier, which stems from failing to mark the cProfile module as insecure, which could lead to the execution of attacker-controlled code...
CVE-2025-13457: Authorization Bypass Through User-Controlled Key
The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the gettokenbyid function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Squa...
PT-2026-1703
Name of the Vulnerable Software and Affected Versions WooCommerce Square versions prior to 5.1.2 Description The WooCommerce Square plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This is due to a lack of validation on a user-controlled key within the get token b...
CVE-2025-69426
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 GA contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY...
Improper Access Control
n8n is vulnerable to Improper Access Control. The vulnerability is due to insecure handling of form-based workflows, which allows an unauthenticated attacker to access files on the underlying server and expose sensitive system information...
CVE-2005-1675
Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 installs the client installation directories with insecure EVERYBODY permissions, which allows local users to gain sensitive information...
CVE-2023-25366
In Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS, insecure SCPI interface discloses web password...