PT-2025-25125 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: A stored Cross-Site Scripting XSS issue affects the software, allowing a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses ...

PT-2025-24487 · Lambertgroup · Lambertgroup Clever

Name of the Vulnerable Software and Affected Versions: LambertGroup CLEVER versions n/a through 2.6 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in LambertGroup CLEVER...

PT-2025-23566 · WordPress · Wpforo

Name of the Vulnerable Software and Affected Versions: wpForo + wpForo Advanced Attachments versions up to, and including, 3.1.3 Description: The issue is related to Stored Cross-Site Scripting via media upload names due to insufficient input sanitization and output escaping. This allows...

The vulnerability of Siemens Scalance LPE9403 industrial switches’ microprogramming software lies in the improper limitation of the path name in the restricted access catalog, which allows attackers to restore backup copies within the system.

The vulnerability of Siemens Scalance LPE9403 industrial switches’ microprogramming software is related to incorrect restrictions on the name of the path to the restricted-access catalog. Exploiting this vulnerability could allow an attacker to restore backup copies within the system...

PT-2025-22902 · Unknown · Proactivanet

Name of the Vulnerable Software and Affected Versions: ProactivaNet version 3.24.0.0 Description: A Privilege Escalation issue has been found in ProactivaNet, allowing any user to override the file panLoad.exe that will be executed by the SYSTEM user via a programmed task. This would allow an...

CVE-2024-36448

UNSUPPORTED WHEN ASSIGNED Server-Side Request Forgery SSRF vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0.13.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restri...

CVE-2024-25644

Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application...

CVE-2024-44121

Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted. The vulnerability could expose internal user data that should remain confidential. It does not impact the integrity and availability of th...

CVE-2024-4811

In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts...

CVE-2024-24739

SAP Bank Account Management BAM allows an authenticated user with restricted access to use functions which can result in escalation of privileges with low impact on confidentiality, integrity and availability of the application...

CVE-2024-11351

The Restrict – membership, site, content and user access restrictions for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.8 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extra...

CVE-2022-31589

Due to improper authorization check, business users who are using Israeli File from SHAAM program /ATL/VQ23 transaction, are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted...

CVE-2022-24398

Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access information which would otherwise be restricted...

CVE-2022-48284

A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could allow attackers to access restricted functions...

CVE-2022-39378

Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restricted access. Before this vulnerability was disclosed, the topic title of the topic associated with the user badge may be viewed by any...

CVE-2019-10083

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents at the top most level, not recursively. The response included details about processors and controller services which the user may not have had read access to...

CVE-2017-18467

cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error SEC-229...

CVE-2000-1230

Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHPAUTHUSER parameter set to "boogieman"...

The vulnerability of the ThinServer.exe executable file of the ThinServer component of the Rockwell Automation ThinManager centralized application management platform allows a attacker to load arbitrary files.

The vulnerability of the ThinServer.exe executable file of the ThinServer component of Rockwell Automation’s ThinManager application platform is related to errors in processing the relative path to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to...

CVE-2025-42997

Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on...