235 matches found
EUVD-2026-35284
SAP MDG Review Match Groups Application does not perform the necessary authorization checks for authenticated users. This could allow a low-privileged user to perform actions that would otherwise be restricted, resulting in escalation of privileges. This has a low impact on integrity, while...
PT-2026-44034
Name of the Vulnerable Software and Affected Versions pretix affected versions not specified Description An insecure direct object reference exists when creating exports through the API. API clients receive a UUID Universally Unique Identifier for export jobs to request the actual file for...
GHSA-6H4J-WCR9-2VG7 n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
Impact The OAuth1 and OAuth2 credential reconnect endpoints authorized access using credential:read rather than credential:update. An authenticated user with read-only access to a shared credential could initiate an OAuth reconnect flow and overwrite the stored token material for that credential...
Do Coding Agents Understand Least-Privilege Authorization?
As coding agents gain access to shells, repositories, and user files, least-privilege authorization becomes a prerequisite for safe deployment: an agent should receive enough authority to complete the task, without unnecessary authority that exposes sensitive surfaces.To study whether current...
CVE-2026-31956 Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to version 4.4.1, any authenticated user can manually construct a URL to preview campaigns/regions, and export saved reports belonging to other users. Exploitation of th...
CVE-2026-3737 SourceCodester Pet Grooming Management Software User Creation add_user.php improper authorization
A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file adduser.php of the component User Creation Handler. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has bee...
CVE-2023-49261
The "tokenKey" value used in user authorization is visible in the HTML source of the login page...
CVE-2022-0919
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number ...
EUVD-2011-1385
Malware in sbrugna...
EUVD-2016-6367
Malware in sbrugna...
EUVD-2016-0355
Malware in sbrugna...
EUVD-2018-4627
Malware in sbrugna...
EUVD-2018-14349
Malware in sbrugna...
EUVD-2019-17892
Malware in sbrugna...
EUVD-2021-26237
Malware in sbrugna...
EUVD-2019-17902
Malware in sbrugna...
EUVD-2019-9478
Malware in sbrugna...
EUVD-2019-0145
Malware in sbrugna...