CVE-2026-111611

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

CVE-2026-111611 roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

EUVD-2026-103033

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

CVE-2026-111611

The roncoo-education platform, through version 25.0.0-RELEASE , is affected by an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). This flaw exists in the pay cancel and continue endpoints, where the application fails to perform proper ownership validation. Authenticated users can...

PT-2026-116010

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

EUVD-2022-33961

Malicious code in bioql PyPI...

CVE-2022-29632

An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-29632

An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-29632

An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-29632

An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file...

Privilege escalation

An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-29632

CVE-2022-29632 affects Roncoo Education v9.0.0. The vulnerability is an arbitrary file upload in the component /course/api/upload/pic, enabling attackers to execute arbitrary code via a crafted file. According to NVD, the CVSS-3.1 base score is 9.8 (CRITICAL) with network access, no privileges re...

CVE-2022-29632

An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file...

PT-2022-19739

Name of the Vulnerable Software and Affected Versions Roncoo Education version 9.0.0 Description The issue is related to an arbitrary file upload vulnerability in the /course/api/upload/pic component, allowing attackers to execute arbitrary code via a crafted file. Recommendations For Roncoo...

CVE-2022-29632: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file...

Roncoo Education 代码问题漏洞

Roncoo Education is an online education platform from China-based Roncoo. A security vulnerability exists in Roncoo Education version v9.0.0, which stems from an arbitrary file upload issue in the /course/api/upload/pic component. An attacker can exploit the vulnerability to execute arbitrary cod...