37456 matches found
PT-2025-49075
Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request...
EUVD-2025-201240
Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a double release of the mpcginfo object, which could lead to memory corruption...
CVE-2025-61148
An Insecure Direct Object Reference IDOR vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'recno' parameter in the /student/get-receipt endpoint...
SolisCloud Monitoring Platform 安全漏洞
SolisCloud Monitoring Platform is a monitoring platform from SolisCloud, Inc. A security vulnerability exists in SolisCloud Monitoring Platform that stems from improper access control and could lead to unsafe direct object references...
PT-2025-49097
Name of the Vulnerable Software and Affected Versions EduplusCampus version 3.0.1 Description An Insecure Direct Object Reference IDOR exists in the Student Payment API. Authenticated users can access other students’ personal and financial records by manipulating the rec no parameter within the...
EduplusCampus 安全漏洞
EduplusCampus is a school management system from EduplusCampus India. A security vulnerability exists in EduplusCampus version 3.0.1, which stems from the presence of an insecure direct object reference in the Student Payment API that could lead to unauthorized access to personal and financial...
CVE-2025-61148
An Insecure Direct Object Reference IDOR vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'recno' parameter in the /student/get-receipt endpoint...
PT-2025-49127
Name of the Vulnerable Software and Affected Versions Medtronic CareLink Network versions prior to December 4, 2025 Description An Insecure Direct Object Reference issue exists in Medtronic CareLink Network. An authenticated attacker, possessing access to specific device and user information, can...
Medtronic CareLink Network 安全漏洞
Medtronic CareLink Network is an open source platform for remote monitoring of cardiac patients by Medtronic in the United States. A security vulnerability exists in versions of Medtronic CareLink Network prior to December 4, 2025, which stems from an insecure direct object reference that could...
PT-2025-49150
Name of the Vulnerable Software and Affected Versions TranzAxis version 3.2.41.10.26 Description Authenticated users can inject cross-site scripting through the Open Object in Tree API endpoint. Successful exploitation may allow attackers to steal session cookies and potentially escalate...
Taiko Alethia 跨站脚本漏洞
Taiko Alethia is an open source Taiko Labs collection of software for implementing the Ethernet-based ZK-EVM Rollup protocol for the Taiko Layer 2 network. A cross-site scripting vulnerability exists in Taiko Alethia version 3.2.41.10.26, which stems from the presence of cross-site script injecti...
CVE-2025-61148
CVE-2025-61148 describes an Insecure Direct Object Reference (IDOR) in EduplusCampus 3.0.1, specifically the Student Payment API. An authenticated user can access other students’ personal and financial records by altering the rec_no parameter in the /student/get-receipt endpoint. The issue is roo...
PT-2025-49142
Name of the Vulnerable Software and Affected Versions SolisCloud API affected versions not specified Description The SolisCloud API has a Broken Access Control issue, specifically an Insecure Direct Object Reference IDOR. An authenticated user can access detailed data for any plant by modifying t...
EUVD-2025-201212
An Insecure Direct Object Reference IDOR vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'recno' parameter in the /student/get-receipt endpoint...
UNA 代码问题漏洞
UNA is a suite of full-stack software platforms for building custom community websites, social networks, and collaboration centers from UNA. A code issue vulnerability exists in UNA versions 9.0.0-RC1 through 14.0.0-RC4, which stems from improper handling of the deserialization of the profileid...
Weitong Mall 安全漏洞
Weitong Mall 微同商城 is a shopping mall system by fuyanglipengjun, an individual developer. A security vulnerability exists in Weitong Mall version 1.0.0, which originates from improper access control of the orderService.queryObject component, which may lead to sensitive information leakage...
CVE-2025-65097 Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections
RomM ROM Manager allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No...
CVE-2025-65097 Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections
RomM ROM Manager allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No...
CVE-2025-65097 Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections
RomM ROM Manager allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No...