113316 matches found
CVE-2026-108868 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications ...
CVE-2026-108867
JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SystemApiController within the getUserRoleSetById handler. This vulnerability allows any authenticated user to access and read the role assignments of other users by supplying an arbitrary userId parameter. Con...
CVE-2026-108867 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId parameter to retrieve assigned role codes...
EUVD-2026-97041
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId parameter to retrieve assigned role codes...
CVE-2026-108867 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId parameter to retrieve assigned role codes...
CVE-2026-108866
JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the /sys/api/queryUserAuths handler. This vulnerability allows authenticated, low-privileged users to provide an arbitrary userId parameter to retrieve the complete permission sets of other accounts. Consequently, ...
CVE-2026-108866 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...
EUVD-2026-97040
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...
CVE-2026-108866 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...
oo
This repository does not have a README...
CVE-2024-10586
CVE-2024-10586 Debug Tool = 2.2 - Unauthenticated Arbitrary File Creation Description: The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including,...
CVE-2024-24684
This repository does not have a README...
CVE-2026-108863
Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...
CVE-2026-108851
phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faqsearch tool that allows MCP clients to read restricted FAQs because Search::searchDatabase never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search...
CVE-2026-108697
CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403 check. Authenticated Pimcore users lacking resource permissions can request the...
CVE-2024-5324
CVE-2024-5324 Login/Signup Popup Inline Form + Woocommerce 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Update Description: The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t...
CVE-2017-16995
This repository does not have a README...
CVE-2017-9830
This repository does not have a README...