38 matches found
EUVD-2026-79300
Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...
CVE-2026-79411
The Webkul Bagisto 2.4.9 software is vulnerable to vertical privilege escalation due to an incorrect privilege assignment in the admin user-management component. The user-update endpoint (route admin.settings.users.update, UserController::update()) fails to verify if an actor is permitted to gran...
Astra Linux – Vulnerability in Firefox
The MarkStack assignment operator, which is part of the JavaScript engine, could access uninitialized memory if it was used in a self-assignment. This vulnerability affects Firefox versions less than 125...
PT-2026-81233
The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...
CVE-2026-44224
Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without...
CVE-2026-31070
The LalanaChami Pharmacy Management System commit 5c3d028 allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative role during registration. The /api/user/signup endpoint fails to validate the role parameter in the request body...
PT-2026-40432
Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without...
CVE-2026-44224: Improper Privilege Management
Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without...
CVE-2025-57605
The AiKaan IoT Platform (an edge device management platform) contains a security vulnerability due to a lack of server-side authorization on department admin assignment APIs. This flaw allows authenticated users to perform unauthorized privilege escalation by assigning themselves as administrator...
PT-2025-38732
Name of the Vulnerable Software and Affected Versions AiKaan IoT Platform affected versions not specified Description A missing server-side authorization check in the department admin assignment APIs within the AiKaan IoT Platform permits authenticated users to gain elevated privileges...
Mozilla: Potential use-after-free due to AlignedBuffer self-move
The Mozilla Foundation Security Advisory describes this flaw as: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free...
Mozilla: Potential use-after-free due to AlignedBuffer self-move
The Mozilla Foundation Security Advisory describes this flaw as: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free...
Mozilla: Potential use-after-free due to AlignedBuffer self-move
The Mozilla Foundation Security Advisory describes this flaw as: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free...
Mozilla: Potential use-after-free due to AlignedBuffer self-move
The Mozilla Foundation Security Advisory describes this flaw as: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free...
Mozilla: Potential use-after-free due to AlignedBuffer self-move
The Mozilla Foundation Security Advisory describes this flaw as: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free...
Mozilla: Potential use-after-free due to AlignedBuffer self-move
The Mozilla Foundation Security Advisory describes this flaw as: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free...
Mozilla: Potential use-after-free due to AlignedBuffer self-move
The Mozilla Foundation Security Advisory describes this flaw as: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free...
Mozilla: Potential use-after-free due to AlignedBuffer self-move
The Mozilla Foundation Security Advisory describes this flaw as: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free...
Mozilla: Potential use-after-free due to AlignedBuffer self-move
The Mozilla Foundation Security Advisory describes this flaw as: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free...
DEBIAN-CVE-2024-3861
If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free. This vulnerability affects Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10...