CVE-2026-33345: Authorization Bypass Through User-Controlled Key

solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/org/projects/project allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index...

PT-2026-27493

solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/org/projects/project allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index...

PT-2025-4035 · Embedai · Embedai

Name of the Vulnerable Software and Affected Versions: EmbedAI versions 2.1 and earlier Description: A Reflected Cross-Site Scripting issue has been identified, allowing an authenticated attacker to craft a malicious URL by leveraging the "/embedai/users/show/" endpoint. This enables the injectio...

PT-2025-4028 · Embedai · Embedai

Name of the Vulnerable Software and Affected Versions: EmbedAI versions 2.1 and below Description: An Improper Access Control issue allows an authenticated attacker to show subscription's information of other users by modifying the SUSCBRIPTION ID parameter of the endpoint...

PT-2025-4031 · Embedai · Embedai

Name of the Vulnerable Software and Affected Versions: EmbedAI versions 2.1 and below Description: An Improper Access Control issue allows an authenticated attacker to obtain files stored by other users by modifying the FILE ID of the endpoint "/embedai/files/show/". Recommendations: For EmbedAI...

PT-2024-33771 · Siadmin · Siadmin

Name of the Vulnerable Software and Affected Versions: SiAdmin version 1.1 Description: The issue allows a remote attacker to send a specially crafted URL to an authenticated user, potentially stealing their cookie session credentials via XSS. This is achieved through the "/show.php" query...

PT-2024-20990 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/WorkFlow/wf office file history show.aspx" API endpoint. Recommendations...

PT-2024-21212 · Amss++ · Amss++

Name of the Vulnerable Software and Affected Versions: AMSS++ version 4.31 Description: The issue allows SQL injection through the /amssplus/modules/person/pic show.php endpoint, in the person id parameter. This could enable a remote attacker to send a specially crafted SQL query to the server an...

PT-2022-17376 · Douco · Douphp

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A stored cross-site scripting XSS issue exists in the upload function of the "/admin/show.php" API endpoint, allowing attackers to execute arbitrary web scripts or HTML via a crafte...