CVE-2026-0603

CVE-2026-0603 : A second-order SQL injection vulnerability in Hibernate Core via the InlineIdsOrClauseBuilder allows a remote attacker with low privileges to craft non-alphanumeric IDs to read sensitive data (e.g., system files) and manipulate or delete data, causing an application‑level denial o...

CVE-2026-0603

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive informatio...

EUVD-2025-206327

A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation...

EUVD-2025-206328

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges...

CVE-2026-0775

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

PT-2026-4522

Name of the Vulnerable Software and Affected Versions SpringBlade version 4.5.0 Description A flaw exists in the authRoutes function that allows attackers with limited privileges to gain higher-level access. The issue is related to incorrect access control within this function. Recommendations...

SpringBlade security vulnerabilities

SpringBlade is a microservices development platform developed by China’s Blade Company. The SpringBlade v4.5.0 version contains a security vulnerability. This vulnerability stems from improper access control in the authRoutes function, which could allow low-privilege attackers to gain higher...

PT-2026-4348

Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

PT-2026-4537

Name of the Vulnerable Software and Affected Versions MyTube versions 1.7.78 and below Description The MyTube application does not properly protect against authorization bypass, potentially allowing guest users to download the complete application database. The application does not validate user...

CVE-2025-70983

CVE-2025-70983 affects SpringBlade v4.5.0. A flaw in the authRoutes function implements incorrect access control, enabling attackers with low privileges to escalate to high privileges. Sources from multiple trackers (Red Hat, NVD, CVE lists, PT-Group) corroborate the description. The publicly sta...

CVE-2025-70983

Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges...

PT-2026-4349

Dell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability in the Server. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

CVE-2025-14750

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges...

CVE-2025-14751

A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation...

CVE-2025-14751

A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation...

CVE-2025-14751

Summary: CVE-2025-14751 describes a vulnerability in the Weintek cMT X Series HMI EasyWeb Service where a low-privileged user can bypass account credentials without verifying the current authentication state, potentially enabling unauthorized privilege escalation. What’s affected (from provided s...

CVE-2025-14750 External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges...

CVE-2025-14750

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges...

CVE-2025-14750

CVE-2025-14750 affects Weintek cMT X Series HMI EasyWeb Service. The vulnerability arises from insufficient validation of inputs that are assumed immutable but are externally controllable, enabling a low-privileged user to modify parameters and potentially escalate privileges to account-level acc...

CVE-2025-14750 External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges...