ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

GHSA-RW26-WWFC-9WVM ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

CVE-2026-114261 MomoTommy file-management-system Files API FileController.php destroy missing authentication

A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in...

EUVD-2026-107367

A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in...

CVE-2026-114261

A vulnerability exists in the MomoTommy file-management-system within the Files API component. The issue affects the index/store/update/destroy functions in the file app/Http/Controllers/FileController.php. Due to missing authentication resulting from the manipulation of the Request argument, an ...

CVE-2026-114260 oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication

A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function deletefolder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The...

CVE-2026-114260

The oretnom23 file-management-system-php (up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 ) contains a missing authentication vulnerability in the AJAX Handler component. Specifically, the delete_folder function within the ajax.php file fails to properly authenticate users when the ID argum...

EUVD-2026-107364

A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function deletefolder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The...

CVE-2026-114260 oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication

A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function deletefolder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The...

CVE-2026-114400

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...

CVE-2026-114397

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODEENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the...

CVE-2026-114248

A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This affects an unknown part of the file /Admin/includes/AddNewPlan-inc.php of the component Plan Management Form. The...

CVE-2026-114248

A security vulnerability exists in the dhikshitha29 Insurance-Management-System within the Plan Management Form component. Specifically, an unknown part of the file /Admin/includes/AddNewPlan-inc.php is susceptible to missing authentication (CWE-306, CWE-287). An attacker can remotely initiate an...

CVE-2026-114248 dhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication

A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This affects an unknown part of the file /Admin/includes/AddNewPlan-inc.php of the component Plan Management Form. The...

CVE-2026-114248 dhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication

A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This affects an unknown part of the file /Admin/includes/AddNewPlan-inc.php of the component Plan Management Form. The...

EUVD-2026-107257

A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This affects an unknown part of the file /Admin/includes/AddNewPlan-inc.php of the component Plan Management Form. The...

CVE-2026-114248 dhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication

A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This affects an unknown part of the file /Admin/includes/AddNewPlan-inc.php of the component Plan Management Form. The...

CVE-2026-114400 Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...

CVE-2026-114400 Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...

CVE-2026-114400 Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...