CVE-2026-71898

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

EUVD-2026-88817

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an incorrect authorization check that allows an authenticated user with only read permission for a project to modify a workflow instance. By accessing the PUT /projects/{projectCode}/workflow-instances/{id} endpoint, which fails to e...

CVE-2026-3057

A security flaw has been discovered in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model/Task.php of the component Backend Interface. The manipulation of the argument projectCode results in sql injection. The attack can be...

CVE-2026-3057 a54552239 pearProjectApi Backend Task.php dateTotalForProject sql injection

A security flaw has been discovered in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model/Task.php of the component Backend Interface. The manipulation of the argument projectCode results in sql injection. The attack can be...

PearProject SQL注入漏洞

PearProject is a project management system backend interface developed by Vilson as an individual project. Versions of PearProject 2.8.10 and earlier had a SQL injection vulnerability. This vulnerability stemmed from the improper handling of the projectCode parameter in the dateTotalForProject...

EUVD-2023-30896

Malicious code in bioql PyPI...

CVE-2023-27112

pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php...

CVE-2023-27112

pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php...

CVE-2023-27112: Improper Neutralization of Special Elements used in an SQL Command

pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php...

CVE-2023-27112

pearProjectApi version v2.8.10 is vulnerable to a SQL injection vulnerability (CWE-89). The flaw exists because the projectCode parameter at the project.php endpoint is not properly neutralized. Attackers could exploit this to interact with the backend database. As a temporary workaround, users s...