CVE-2024-55271

Gym Management System CVE-2024-55271 Ein Gym-Management-System, das mit PHP und MySQL erstellt wurde. Auditor Shoaib Alam - LinkedIn-Profil Beschreibung CSRF-Schwachstelle im Profilaktualisierungsbereich Im Gym Management System wurde eine Cross-Site-Request-Forgery-Schwachstelle CSRF...

CVE-2025-66683

CVE-2025-66683 Eine Cross-Site-Request-Forgery CSRF-Sicherheitslücke besteht in der Funktion zur Aktualisierung des Administratorprofils von CarRentalMS v2.0. Der betroffene Endpunkt implementiert keine Anti-CSRF-Schutzmaßnahmen, wodurch ein Angreifer über manipulierte HTML-Inhalte unbefugte...

CVE-2023-46478

CVE-2023-46478 Minical 1.0.0 è vulnerabile a IDOR . Fornitore: https://github.com/minical/minical Applicazione demo: https://demo.minical.io/ PoC Passaggio 1: Ho creato due account utente: prima l'utente A hacker, poi l'utente B walker-448 Passaggio 2: Vai all'account dell'utente B, poi naviga ne...

EUVD-2026-67003

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Autorizzazione mancante per aggiornamento non autenticato di opzioni limitate Il plugin Tutor LMS – soluzione eLearning e corsi online per WordPress è vulnerabile a modifiche non autorizzate dei dati a causa di un controllo di capacità mancante sulla funzione...

CVE-2026-67578

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

EUVD-2026-64841

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

CVE-2026-4244

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

EUVD-2026-64275

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

CVE-2026-63042

Apache InLong (versions 2.0.0 through before 2.4.0) contains a missing authorization flaw on its DataNode management endpoints. Any user who can authenticate to the manager can create, modify, and delete Data Node definitions , leading to high impact on integrity and availability (CVSS 8.1, HIGH)...

BIT-KIBANA-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...

CVE-2026-14825

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

EUVD-2026-62262

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores...

CVE-2026-29036

Affected software: cJSON library (versions 1.5.0–1.7.19). Component: decode_pointer_inplace() in cJSON_Utils.c. Issue: Incorrectly-resolved name/reference vulnerability that lets unauthenticated attackers manipulate JSON Patch paths by supplying crafted JSON Pointer escape sequences (~0, ~1). Imp...

UBUNTU-CVE-2026-19550

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

CVE-2026-19550

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

CVE-2026-18712

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

CVE-2026-18712

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

CVE-2026-18712

CVE-2026-18712 describes an issue in MongoDB Server’s Queryable Encryption maintenance operations. An authenticated user who has privileges on one encrypted collection could cause unauthorized modification or destruction of data in a different collection due to insufficient validation of internal...