35759 matches found
CVE-2026-110099
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/id and hr/exportOvertime/id to downloa...
CVE-2026-110099 Jorani before 1.0.4 Missing Authorization in HR Export Actions
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/id and hr/exportOvertime/id to downloa...
CVE-2026-110099
The Jorani application (versions before 1.0.4 ) is susceptible to a missing authorization vulnerability within the Hr controller . Specifically, the exportLeaves, exportOvertime, and exportEmployees actions do not properly restrict access, allowing any authenticated user to export sensitive HR da...
CVE-2026-109524
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorizatio...
CVE-2026-109525 girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username/timestamp/status leads to...
CVE-2026-109525
A vulnerability exists in the girishsaraf Online-Appointment-Booking-System (up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5) involving a missing authorization flaw in the submit2 Handler component, specifically within the changebookingstatus.php file. Attackers can remotely manipulate the ...
CVE-2026-109524
The girishsaraf Online-Appointment-Booking-System contains a vulnerability in the Admin/showdoctor.php file within the Admin Display Pages component. This issue stems from missing authorization (CWE-862, CWE-863), allowing for remote manipulation. While the exploit has been publicly disclosed , t...
CVE-2026-109524 girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorizatio...
CVE-2026-109524 girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorizatio...
WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Listing Deletion vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Directorist versions = 8.10.2.1...
CVE-2026-109962
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain...
Role: DNS Server Tampering Vulnerability
Missing authorization in DNS Server allows an authorized attacker to perform tampering locally...
Role: DNS Server Tampering Vulnerability
Missing authorization in DNS Server allows an authorized attacker to perform tampering locally...
CVE-2026-109962 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain...
CVE-2026-109962
Froxlor versions 0.10.0 before 2.3.14 are vulnerable to a missing authorization flaw in the MysqlServer and Cronjobs APIs. This vulnerability allows reseller accounts to bypass intended restrictions and read administrative-only configurations by calling MysqlServer.listing, MysqlServer.get, or Cr...
CVE-2026-109962 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain...
CVE-2026-65172
NVIDIA AIStore for Linux and Kubernetes is affected by a missing authorization vulnerability in its ETL management API . An unauthenticated remote attacker can exploit this by sending crafted GET or POST requests to an AIStore proxy . Successful exploitation can lead to information disclosure and...
CVE-2026-65172
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may...