40 matches found
EUVD-2026-90494
Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. Thi...
PT-2026-81222
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The frontend detail-view document lookup fails to apply the siteHash filter for the current site and the frontend user access filter. This differs from the regul...
CVE-2026-57870
Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3...
CVE-2026-53867
Capgo before 12.128.2 does not delete previously uploaded profile images, leaving orphaned files accessible via previously generated URLs, enabling unauthorized retrieval of user-uploaded content. This affects Capgo's backend storage handling when users replace or remove images. The CVE notes MED...
CVE-2026-53867 Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement
Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content...
CVE-2026-53867: Incomplete Cleanup
Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content...
PT-2026-24816
🚨 CVE-2026-32097 PingPong is a platform for using large language models LLMs for teaching and learning. Prior to 7.27.2, an authenticated user may be able to retrieve or delete files outside the intended authorization scope. This issue could result in retrieval or deletion of private files,...
PT-2025-52612
Name of the Vulnerable Software and Affected Versions HappyDevs TempTool versions through 1.3.1 Description HappyDevs TempTool contains a flaw that could allow unauthorized retrieval of embedded sensitive data, potentially exposing sensitive system information. Recommendations Update HappyDevs...
CVE-2025-41016
CVE-2025-41016 affects Davantis DFUSION v6.177.7. The vulnerability is an inadequate access control that lets unauthorised actors access alarm media via /alarms//, where MEDIA can be snapshot or video.mp4, exposing images/videos from triggered alerts. CVSSv4 base score 8.7 (HIGH) with NETWORK att...
EUVD-2022-7426
Malicious code in bioql PyPI...
CVE-2022-45921
FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process...
CVE-2025-47540
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs weMail wemail allows Retrieve Embedded Sensitive Data.This issue affects weMail: from n/a through = 1.14.13...
CVE-2025-31832
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beee ACF City Selector acf-city-selector allows Retrieve Embedded Sensitive Data.This issue affects ACF City Selector: from n/a through = 1.17.0...
CVE-2024-11916: Missing Authorization
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with...
CVE-2023-50310: Insufficiently Protected Credentials
IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval...
CVE-2024-49284
CVE-2024-49284 (WP SendFox) : A sensitive data exposure vulnerability in the WordPress plugin WP SendFox (BogdanFix) affects versions
CVE-2024-38467
Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API...
CVE-2024-38467
The Shenzhen Guoxin Synthesis image system versions prior to 8.3.0 are vulnerable to unauthorized user information retrieval. The root cause is an insecure queryUser API endpoint that allows for the exposure of sensitive user data to unauthorized actors. To remediate this vulnerability, users sho...
CVE-2024-22345: Insufficiently Protected Credentials
IBM TXSeries for Multiplatforms 8.2 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. IBM X-Force ID: 280192...