CVE-2026-17538: Authorization Bypass Through User-Controlled Key

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

CVE-2022-27960: Incorrect Default Permissions

Insecure permissions configured in the userid parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' personal information...

PT-2019-15224

Name of the Vulnerable Software and Affected Versions eyecomms eyeCMS versions prior to 2019-10-15 Description The issue allows any candidate to modify other candidates' personal information, including first name, last name, email, CV, phone number, and other details, by altering the id parameter...

ECShop V2. 7. 3 GBK release1106 injection 0day and fix-vulnerability warning-the black bar safety net

C0deplay Team j8g Look at the code / Modify personal information / elseif $action == ‘acteditprofile’ the includeonceROOTPATH . ‘includes/libtransaction.php’; $birthday = trim$POST'birthdayYear' .’-’. trim$POST'birthdayMonth' .’-’. trim$POST'birthdayDay'; $email = trim$POST'email'; $other'msn' =...