PT-2026-25894

Name of the Vulnerable Software and Affected Versions HCL Sametime affected versions not specified Description HCL Sametime is susceptible to a server-side validation flaw. The application implements client-side input validation, but these checks are not replicated on the web server. This allows ...

Online Store Platform File Read

The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to insufficient validation of requests at the server side. Exploiting this vulnerability allows a malicious actor to read arbitrary files...

Online Store Server Side Validation

The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to insufficient validation of requests at the server side. Exploiting this vulnerability can allow a malicious actor to bypass security...

CVE-2025-31966: Improper Input Validation

HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server. An attacker can bypass these restrictions by sending manipulated HTTP requests directly to the server...

Moodle Insufficient Validation Unauthorized Access

The vulnerability in the virtual learning environment Moodle is related to insufficient testing of server-side requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

WebEx Zimlet SSRF

The vulnerability of the WebEx Zimlet component in the Zimbra Collaboration Suite email management system is related to insufficient validation of requests at the server-side level. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

Progress MOVEit Transfer Insufficient Validation Unauthorized Access

The vulnerability of the software for processing and transmitting confidential data in Progress MOVEit Transfer is related to insufficient validation of requests on the server side. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected...

ROS-20260216-73-0024

A vulnerability in the Zabbix IT infrastructure monitoring system is related to insufficient server-side request validation. Exploitation of the vulnerability could allow an attacker acting remotely to gain read access to the data...

ROS-20260216-73-0025

A vulnerability in the Zabbix IT infrastructure monitoring system is related to insufficient server-side request validation. Exploitation of the vulnerability could allow an attacker acting remotely to gain read access to the data...

ROS-20260216-73-0023

A vulnerability in the Zabbix IT infrastructure monitoring system is related to insufficient server-side request validation. Exploitation of the vulnerability could allow an attacker acting remotely to gain read access to the data...

ELMA365 SSRF

The vulnerability of the BPM platform for comprehensive process automation in ELMA365 is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack remotely...

Adminer SSRF

The vulnerability of Adminer’s database management software is related to insufficient testing of queries on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

Omada Controllers Unauthorized Access

The vulnerability of the software for Omada Controllers, which manage corporate networks, is related to insufficient validation of requests on the server side. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

zVirt Configuration Data Access

The vulnerability of the configuration data storage mechanism of the zVirt virtualization platform is related to insufficient validation of requests on the server side. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to configuration data...

Advisory ROSA-SA-2026-3115

software: apache 2.4.66 OS: ROSA-CHROME unaffected versions = apache-2.4.66-1 affected versions apache-2.4.66-1 CVE-ID: CVE-2025-66200 BDU-ID: 2025-15638 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the moduserdir module of the Apache HTTP Server web server involves bypassing the authentication...

Tucows (VDP): Password Strength Policy Bypass via Server-Side Validation Flaw

A password strength policy bypass was discovered due to a server-side validation flaw. The password strength policy was only enforced in the browser, not on the server side...

CVE-2026-24035

Horilla is a free and open source Human Resource Management System HRMS. An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on behalf of another employee without prope...

Horilla Access Control Vulnerability

Horilla is a free open-source human resources software developed by Horilla Company. Versions of Horilla from 1.4.0 to 1.5.0 contained an access control vulnerability. This vulnerability stemmed from insufficient validation of the employeeid parameter on the server side, allowing any authenticate...

CVE-2026-0808 Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter

The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated...

Structurizr chart creation tool Unauthenticated Access Disclosure

The vulnerability of the Structurizr diagramming tool is related to insufficient validation of requests on the server side. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...