CVE-2026-70561: Authorization Bypass Through User-Controlled Key

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...

PT-2018-4273

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 2.8.13 Description The issue allows remote attackers to read arbitrary attachments via a direct request. Recommendations For versions prior to 2.8.13, update to version 2.8.13 or later to resolve the issue...

PT-2016-4878

Name of the Vulnerable Software and Affected Versions Micro Focus Novell Service Desk versions prior to 7.2 Description The issue allows remote authenticated users to read arbitrary attachments via a request to a "LiveTime.woa" URL. This can be achieved by obtaining sensitive information via a 1...