CVE-2026-54643 CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated...

CVE-2026-54643: Missing Authorization

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated...

CVE-2026-14791

A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attac...

CVE-2026-14791

A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attac...

CVE-2026-14791

CVE-2026-14791 affects crater-invoice-inc crater up to 6.0.6. The vulnerability exists in the function getFormattedString of app/Http/Requests/InvoicesRequest.php within the Invoice Note Handler . Manipulating the argument notes may lead to cross-site scripting (XSS) . The attack can be launched ...

CVE-2026-14791 crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting

A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attac...

CVE-2026-14791: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attac...

CVE-2026-14753

A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /PHP/objects/notes of the component Note Handler/Assignment Handler. Performing a manipulation of the argument assignmentitemid results in authorization...

CVE-2026-14753 mjperpinosa stumasy Note Handler/Assignment notes authorization

A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /PHP/objects/notes of the component Note Handler/Assignment Handler. Performing a manipulation of the argument assignmentitemid results in authorization...

EUVD-2026-41759

A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /PHP/objects/notes of the component Note Handler/Assignment Handler. Performing a manipulation of the argument assignmentitemid results in authorization...

PT-2026-55799

Name of the Vulnerable Software and Affected Versions mjperpinosa stumasy versions up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be Description An authorization bypass exists in the Note Handler/Assignment Handler component within the /PHP/objects/notes file. A remote attacker can trigger this issu...

Deserialization of untrusted data

A vulnerability classified as critical was found in vanderSchaar LAB AutoPrognosis 0.1.21. This vulnerability affects the function loadmodelfromfile of the component Release Note Handler. The manipulation leads to deserialization. The attack can be initiated remotely. The complexity of an attack ...

CVE-2024-1748

CVE-2024-1748 affects van_der_Schaar LAB AutoPrognosis 0.1.21, specifically the Release Note Handler's function load_model_from_file , where input deserialization leads to a vulnerability. Descriptions across sources indicate remote initiation with high impact on confidentiality, integrity, and a...

CVE-2024-1748 van_der_Schaar LAB AutoPrognosis Release Note load_model_from_file deserialization

A vulnerability classified as critical was found in vanderSchaar LAB AutoPrognosis 0.1.21. This vulnerability affects the function loadmodelfromfile of the component Release Note Handler. The manipulation leads to deserialization. The attack can be initiated remotely. The complexity of an attack ...

PT-2024-18273 · Van Der Schaar · Van Der Schaar Lab Autoprognosis

Name of the Vulnerable Software and Affected Versions: van der Schaar LAB AutoPrognosis version 0.1.21 Description: A critical vulnerability was found in the function load model from file of the component Release Note Handler. The manipulation leads to deserialization. The attack can be initiated...

CVE-2024-1748: Deserialization of Untrusted Data

A vulnerability classified as critical was found in vanderSchaar LAB AutoPrognosis 0.1.21. This vulnerability affects the function loadmodelfromfile of the component Release Note Handler. The manipulation leads to deserialization. The attack can be initiated remotely. The complexity of an attack ...

van_der_Schaar LAB AutoPrognosis Code Issue Vulnerability

AutoPrognosis is a vanderSchaar LAB open source predictive modeling pipeline for clinical prognosis. A code issue vulnerability exists in vanderSchaar LAB AutoPrognosis version 0.1.21, which stems from a security vulnerability in the loadmodelfromfile function in the component Release Note Handle...