CVE-2026-55739

Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and -hasCompany-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound custome...

CVE-2022-29749

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=deleteinvoice...