CVE-2023-46980

CVE-2023-46980 An issue in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter. Additional Information Video POC Link On YT ; https://youtu.be/3Mz2lSElg7Y Vulnerability Type Incorrect Access...

Leantime < 2.4 - Authenticated SQL Injection

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

CVE-2026-71854

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the /api/player/ lessons endpoints can be called without authentication, and they trust a client-supplied...

CVE-2026-71854 OpenAEV has unauthenticated access and missing object-level authorization on player lessons API

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the /api/player/ lessons endpoints can be called without authentication, and they trust a client-supplied...

CVE-2023-34732

CVE-2023-34732 Authenticated Function Abuse for Account Takeover Description An attacker can brute-force any user's password including admins using the userId parameter in the change password functionality and update the user's password to a new one chosen by the attacker. CVSS Score: 8.8 High...

CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-109206

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet /avatar performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compa...

EUVD-2026-97439

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet /avatar performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compa...

CVE-2026-109206

LogicalDOC Community Edition through version 9.3 is vulnerable to username enumeration via the AvatarServlet (/avatar). The root cause is a lack of session validation , allowing unauthenticated attackers to provide usernames or numeric IDs in the userId parameter. By comparing 1x1 transparent ima...

CVE-2026-109206 LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet /avatar performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compa...

CVE-2026-109206 LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet /avatar performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compa...

CVE-2026-108866 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...

EUVD-2026-96611

JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video...

EUVD-2026-96548

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech...

CVE-2026-108672

JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video...

CVE-2026-108662

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user...

CVE-2026-108609

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech...

CVE-2026-108672

JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video...

CVE-2026-108672 JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser

JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video...

CVE-2026-108672

JeecgBoot versions through 3.9.5 are susceptible to an authorization bypass vulnerability within the getVideoRecords handler of the VideoGenerationController. This flaw allows authenticated users to access the records of other users by manipulating the userId parameter. Specifically, low-privileg...