PT-2025-7870 · Amelia · Amelia

Name of the Vulnerable Software and Affected Versions: Amelia versions 1.2.16 and earlier Description: The issue affects Amelia due to an Authorization Bypass Through User-Controlled Key vulnerability, which exploits incorrectly configured access control security levels. Recommendations: For...

PT-2025-7875 · Ninja Team · Filebird

Name of the Vulnerable Software and Affected Versions: Ninja Team Filebird versions 6.4.2.1 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key, which can be exploited due to incorrectly configured access control security levels. Recommendations: F...

CVE-2024-55898 IBM i privilege escalation

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege...

Grafana Authentication Bypass

The vulnerability of the Grafana data processing web tool relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely influence the integrity of the protected information...

CVE-2025-27108

dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's .replace opens up to potential Cross-site Scripting XSS vulnerabilities with the special replacement patterns beginning with $. Particularly, when the attributes of Meta tag from...

CVE-2025-27108 Cross-site Scripting vulnerability due to improper use of string.replace in dom-expressions

dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's .replace opens up to potential Cross-site Scripting XSS vulnerabilities with the special replacement patterns beginning with $. Particularly, when the attributes of Meta tag from...

CVE-2025-27108

CVE-2025-27108 affects dom-expressions. The vulnerability arises from using JavaScript String.replace with special replacement patterns (notably $' and $�60) when injecting assets into HTML headers via solid-meta, where user-controlled attributes (Meta tags) can be manipulated to achieve XSS. Thi...

CVE-2024-13719

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...

CVE-2024-13719

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...

CVE-2024-12651

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...

CVE-2024-12651

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...

CVE-2024-12651

CVE-2024-12651 affects the PTT HGS Mobile App prior to version 6.5.0. The issue is an Exposed Dangerous Method or Function vulnerability that allows manipulating user-controlled variables. The NVD/NIST record lists a CVSS v3.1 base score of 8.5 (HIGH) with Network attack vector, Low privileges re...

CVE-2024-12651 Sensitive Data Exposure in PTT Inc.'s HGS Mobile App

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables.This issue affects HGS Mobile App: before 6.5.0...

CVE-2024-12651 Sensitive Data Exposure in PTT Inc.'s HGS Mobile App

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...

CVE-2024-12651: Exposed Dangerous Method or Function

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...

PT-2025-6533

Name of the Vulnerable Software and Affected Versions BSS Software Mobuy Online Machinery Monitoring Panel versions prior to 2.0 Description The issue affects BSS Software Mobuy Online Machinery Monitoring Panel, allowing SQL Injection due to an Authorization Bypass Through User-Controlled SQL...

Path Traversal

github.com/clidey/whodb/core is vulnerable to Path Traversal. The vulnerability is due to improper path validation due to the lack of checks when joining user-controlled database file names with the default directory, allowing an attacker to use path traversal ../../ to access any Sqlite3 databas...

CVE-2025-23363

Summary (CVE-2025-23363): Siemens Teamcenter V14.x products disclose an open-redirect issue in the SSO login service. The SSO accepts user-controlled input that can specify an external URL, enabling an attacker to lure a legitimate user into clicking a crafted link that redirects to a malicious s...

CVE-2025-22695

Authorization Bypass Through User-Controlled Key vulnerability in NirWp Team Nirweb support nirweb-support.This issue affects Nirweb support: from n/a through = 3.0.3...

WhoDB has a path traversal opening Sqlite3 database

Summary While the application only displays Sqlite3 databases present in the directory /db, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Details WhoDB allows use...