115654 matches found
KOMTEK Cassa Kurier Module Authentication Bypass
Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management is associated with the absence of authentication for a critical function. Exploitation of this vulnerability may allow an attacker to compromise the integrity and accessibility of...
Ascon.Pilot.WinService Authentication Bypass
The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker operating remotely to compromise the confidentiality, integrity, and accessibility o...
Ascon.Pilot.WinService Auth Bypass Code Execution
The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-116010
RosarioSIS versions prior to 12.9.1 are susceptible to a missing authorization vulnerability. Authenticated teachers can manipulate records for students outside their assigned course periods by providing arbitrary student IDs. Specifically, an attacker can modify the st_arr, values, or attendance...
EUVD-2026-109268
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the starr, values, or attendance POST arrays in MakeReferral.php,...
CVE-2026-116008
DaybydayCRM versions through 2.2.1 are vulnerable to a missing authorization flaw in the ProjectsController::updateAssign() function. The vulnerability allows any authenticated user to bypass the can-assign-new-user-to-project permission. By sending PATCH or POST requests to /projects/updateassig...
EUVD-2026-109266
DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to...
EUVD-2026-109263
Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13...
DDosTool
This repository does not have a README...
EUVD-2026-109254
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...
CVE-2024-50475
CVE-2024-50475 Signup Page = 1.0 - Unauthenticated Arbitrary Options Update Description: The Signup Page plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in all versions up to, and including, 1.0. This...
CVE-2020-1938
This repository does not have a README...
CVE-2018-6574
This repository does not have a README...
CVE-2025-24813
This repository does not have a README...
cve-2018-6574
This repository does not have a README...
cve-2017-11176
This repository does not have a README...
CVE-2023-31852
CVE-2023-31852 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/wireless/config has reflected XSS via the iface parameter. The methods of exploitation would involve sending a specially crafted request to the...
CVE-2022-45728
This repository does not have a README...