Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure. id: CVE-2025-41243 info: name:...

CVE-2026-58394

The OPNsense firewall and routing platform is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 26.1.11 . The vulnerability exists because src/www/system_advanced_admin.php fails to include the $a_cert array in the legacy_html_escape_form_data() function before rendering certif...

EUVD-2026-102135

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata before rendering each certificate descr value in the SSL Certificate selector. The...

EUVD-2026-100194

External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally...

CVE-2026-108795

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

CVE-2026-108795

A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 within the System Settings API component. Specifically, an unknown functionality in the file /base/api/systemSettings suffers from improper access controls (CWE-284, CWE-266). An attacker can initiate this attack remotely to manip...

EUVD-2026-97166

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

CVE-2026-108795 ZKTeco BioTime System Settings API systemSettings access control

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

CVE-2026-108795 ZKTeco BioTime System Settings API systemSettings access control

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

CVE-2026-108795: Improper Access Control

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

PT-2026-110435

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 9.5.6 Build 20260130.3206 Description Improper access controls exist within the System Settings API component. A remote attacker can exploit this by manipulating the '/base/api/systemSettings' endpoint to gain unauthoriz...

PT-2026-84444

A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate their user privileges to those of a higher role. A successful exploit allows the attacker to change the state of certain settings of the...

CVE-2026-81743

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-81743: Improper Limitation of a Pathname to a Restricted Directory

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-79672

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

CVE-2026-19904

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

EUVD-2026-59783

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

CVE-2026-19904

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

CVE-2026-19904: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

PT-2026-73044

Name of the Vulnerable Software and Affected Versions SourceCodester Online Book Store System version 1.0 Description Cross site scripting occurs in the System Settings Module within the file '/admin/index.php?page=site settings'. This issue allows a remote attacker to execute malicious scripts...