Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update

Impact The BulkAssetsController::update method accepts companyid directly from user input without calling Company::getIdForCurrentUser, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking...

CVE-2026-56396

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser and updateUserRights endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edituser permission can set issuperadmin flag or grant arbitrary rights to escalate to SuperAdm...

EUVD-2020-2694

Malware in sbrugna...

CVE-2020-10239

An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of comfields allows access for non-superadmin users...

CVE-2020-10239

An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of comfields allows access for non-superadmin users...

[20200305] - Core - Incorrect Access Control in com_fields SQL field

Incorrect Access Control in the SQL fieldtype of comfields allows access for non-superadmin users...