578 matches found
CVE-2026-107047
Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data...
CVE-2026-117606 NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...
CVE-2026-117606 NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...
CVE-2026-117606
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...
PT-2026-127730
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used by with the user. Attackers holding the default nexopos.use.registers permission can submit...
CVE-2026-116208 YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities durin...
CVE-2026-112287 Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy...
Krayin Laravel-CRM authorization issue vulnerability
The Krayin Laravel-CRM version 2.2.7 and earlier have a security vulnerability. This vulnerability stems from improper object-level authorization in the EmailController’s write operations. It allows authorized users with limited permissions to manipulate other users’ emails by providing digital...
CVE-2026-111660
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
CVE-2026-111660 waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
EUVD-2026-103082
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
CVE-2026-111660
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
CVE-2026-111660 waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
CVE-2026-111660 waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
CVE-2026-111660
The waynboot-mall software (through version 2.0.0 ) is vulnerable to a missing authentication flaw (CWE-306) within the /callback/order/unpaid endpoint. This vulnerability allows unauthenticated attackers to cancel any member's pending orders by submitting predictable orderSn values, which are co...
CVE-2026-111660: Missing Authentication for Critical Function
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
PT-2026-116059
🚨 CVE-2026-111660 waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a...
CVE-2026-21139
Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device...
CVE-2026-109323: Missing Authorization
Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only voteaccess and readonly enforcement. Attackers can use the anonymous nonce emitted by getData to submit votes directly to addVote, manipulatin...