The vulnerability of the BentoML library, related to insufficient validation of requests on the server side, allows a attacker to execute an SSRF attack.

The vulnerability of the BentoML library is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

The vulnerability of IBM Concert Software’s artificial intelligence-based automation tools lies in the insufficient validation of requests on the server side, allowing attackers to execute SSRF attacks.

The vulnerability of IBM Concert Software’s artificial intelligence-based automation tools lies in insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack remotely...

The vulnerability of the Zabbix IT-infrastructure monitoring system lies in the insufficient checking of requests on the server side, allowing a hacker to gain access to read data.

The vulnerability of the Zabbix IT-infrastructure monitoring system is related to insufficient checking of requests on the server side. Exploiting this vulnerability can allow a malicious actor to gain read access to data...

Improper Input Validation

mantisbt/mantisbt is vulnerable to improper input validation. The vulnerability is due to lack of server-side validation on note length, which allows an attacker to submit excessively long notes and corrupt the issue activity logs, thereby breaking the activity stream UI and preventing future...

CVE-2025-14265

CVE-2025-14265 (ScreenConnect) affects the ScreenConnect server component (not host/guest clients). The issue is due to insufficient server-side validation and integrity checks within the extension subsystem, allowing the installation and execution of untrusted or arbitrary extensions by authoriz...

EUVD-2025-202687

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of...

CVE-2025-14265 Improper server-side validation in ScreenConnect extension framework

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of...

PT-2025-50611

Name of the Vulnerable Software and Affected Versions ScreenConnect versions prior to 25.8 Description The ScreenConnect server component, in versions prior to 25.8, has insufficient server-side validation and integrity checks within its extension subsystem. This allows the installation and...

1Panel – CAPTCHA Bypass via Client-Controlled Flag

Summary A CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed,...

The vulnerability of the Apache HTTP Server’s web server lies in the insufficient checking of requests at the server side, allowing attackers to access NTLM hashes.

The vulnerability of the Apache HTTP Server is related to insufficient validation of requests at the server side. Exploiting this vulnerability allows a malicious actor to gain access to NTLM hashes by sending specially crafted requests...

CVE-2025-65844

EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary...

EUVD-2025-199636

Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data e.g., user profiles, project records fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This...

CVE-2025-64067

Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data e.g., user profiles, project records fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This...

CVE-2025-64062

The Primakon Pi Portal version 1.0.18 is vulnerable to an improper authorization flaw in the /api/V2/pp_users?email endpoint. The root cause is a lack of server-side validation against the authenticated session when filtering user data. An attacker can manipulate the email parameter to an arbitra...

CVE-2025-64062

The Primakon Pi Portal 1.0.18 /api/V2/ppusers?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value e.g., [email protected], an attacker can assume the session and gain...

CVE-2025-64067

Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data e.g., user profiles, project records fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This...

PT-2025-48065

Name of the Vulnerable Software and Affected Versions Primakon Pi Portal version 1.0.18 Description The /api/V2/pp users?email endpoint lacks proper server-side validation against the authenticated session. Manipulating the email parameter to an arbitrary value, such as [email protected], allows...

CVE-2025-64065

The Primakon Pi Portal version 1.0.18 contains an access control failure in the /api/V2/pp_udfv_admin API endpoint. Due to a Broken Function Level Authorization and Insecure Design , the administrative LoginAs feature fails to verify the caller's privileges or require a target user's password or ...

CVE-2025-65094 WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)

WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by manipulating the groups parameter in the /admin/users/save.php request. The UI restricts users to assigning only their existing group, bu...

CVE-2025-65094 WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)

WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by manipulating the groups parameter in the /admin/users/save.php request. The UI restricts users to assigning only their existing group, bu...