PT-2026-22577

Name of the Vulnerable Software and Affected Versions CGM CLININET affected versions not specified Description The application utilizes direct, sequential object identifiers, specifically the MessageID parameter, without sufficient authorization controls. An attacker can potentially access messag...

CVE-2025-58402: Authorization Bypass Through User-Controlled Key

The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users...

CVE-2026-3185

A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component API Endpoint. The manipulation of the argument messageId results in authorization bypass. The attack can be launched remotely. The exploi...

CVE-2026-3185 feiyuchuixue sz-boot-parent API Endpoint sys-message authorization

A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component API Endpoint. The manipulation of the argument messageId results in authorization bypass. The attack can be launched remotely. The exploi...

Sz-Admin 安全漏洞

Sz-Admin is a mid-backend management software developed by INS6+ individuals. Versions of Sz-Admin such as 1.3.2-beta and earlier contained security vulnerabilities. These vulnerabilities were caused by incorrect handling of the parameter messageId in files/api/admin/sys-message/, which could lea...

PT-2026-21907

A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component API Endpoint. The manipulation of the argument messageId results in authorization bypass. The attack can be launched remotely. The exploi...

CVE-2026-3185: Authorization Bypass Through User-Controlled Key

A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component API Endpoint. The manipulation of the argument messageId results in authorization bypass. The attack can be launched remotely. The exploi...

EUVD-2005-3870

Malware in sbrugna...

magicflue file upload vulnerability

magicflue is a digital nervous system of China magicflue company, which can support the integration of complex business scenarios and complex IT environment without code platform. A file upload vulnerability exists in magicflue, which can be exploited by an attacker to execute arbitrary code via ...

CVE-2024-28441

File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of the mail/mailupdate.jsp endpoint...

CVE-2024-28441: Unrestricted Upload of File with Dangerous Type

File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of the mail/mailupdate.jsp endpoint...

PT-2024-22437 · Magicflue · Magicflue

Name of the Vulnerable Software and Affected Versions: magicflue versions 7.0 and earlier Description: The issue allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of the "mail/mailupdate.jsp" endpoint. This enables the attacker to potentially gain...

CVE-2019-20896

WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter...

CVE-2019-20896: Improper Neutralization of Special Elements used in an SQL Command

WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter...

Chamilo LMS IDOR - 'messageId' Delete POST Injection

Document Title: =============== Chamilo LMS IDOR - messageId Delete POST Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1720 Video: https://www.youtube.com/watch?v=3ApPhUIk12Y Release Date: ============= 2016-02-15 Vulnerability...

CVE-2014-8487: Exposure of Sensitive Information to an Unauthorized Actor

Kony Management aka Enterprise Mobile Management or EMM 1.2 and earlier allows remote authenticated users to read 1 arbitrary messages via the messageId parameter to selfservice/managedevice/getMessageBody or 2 requests via the requestId parameter to selfservice/devicemgmt/getDeviceInfoTab.htm...

CVE-2013-2585

Cross-site scripting XSS vulnerability in Atmail Webmail Server 6.6.x before 6.6.3 and 7.0.x before 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId//filenameOriginal/...

CVE-2014-0616

Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R4-S2, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows remote attackers ...

Sql injection

SQL injection vulnerability in silentumguestbook.php in Silentum Guestbook 2.0.2 allows remote attackers to execute arbitrary SQL commands via the messageid parameter...

CVE-2009-4687: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in silentumguestbook.php in Silentum Guestbook 2.0.2 allows remote attackers to execute arbitrary SQL commands via the messageid parameter...