CVE-2025-26370: Missing Authorization

A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to remove privileges from user groups via crafted HTTP requests...

Online Store System Access Control Error Vulnerability

Online Store System is an e-commerce system. An Access Control Error vulnerability exists in Online Store System v1.0. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploit the vulnerability...