4 matches found
CVE-2025-25618
CVE-2025-25618 Unifiedtransform v2.0 存在不正确的访问控制漏洞，允许教师更改班级名称和房间号——这些权限本应仅限管理员操作。 供应商：Unifiedtransform PoC 步骤1： 以教师身份登录应用程序。 步骤2： 浏览以下端点： /section/edit/1 步骤3： 修改班级名称和房间号字段，然后点击保存。 影响： 对班级详情进行未经授权的更改可能导致学术运营中的管理混乱。教师擅自修改这些关键信息会扰乱班级分配、课程安排和教室管理，而这些操作本应仅由管理员处理。 漏洞类型： 不正确的访问控制 攻击类型： 远程 影响： 权限提升 攻击向量：...
JFinalCMS 安全漏洞
JFinalCMS is a content management system. JFinalCMS v5.0.0 version exists cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the section management department, an attacker can exploit this vulnerability by injecti...
The vulnerability of the Kafka platform’s message and section management package for security organization, automation, and Cortex XSOAR responses lies in the unencrypted storage of key certificates, allowing attackers to gain unauthorized access to protected information.
The vulnerability of the Kafka platform’s message and section management package for security organization, automation, and Cortex XSOAR response is related to the unencrypted storage of key certificates. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to...
