EUVD-2026-98931

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

CVE-2026-110098 Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

CVE-2025-25241: Missing Authorization

Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability...

PT-2025-6135 · Sap · Sap Fiori Apps Reference Library

Name of the Vulnerable Software and Affected Versions: SAP Fiori Apps Reference Library My Overtime Requests affected versions not specified Description: The issue is caused by a missing authorization check, allowing an attacker who is logged in to the application to view or delete 'My Overtime...