CVE-2025-58386

In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new...

CVE-2025-58386

Terminalfour versions 8 through 8.4.1.1 are vulnerable to a privilege escalation flaw due to insufficient server-side authorization checks on the userLevel parameter in the user management function. A Power User can intercept and modify this parameter to assign the Administrator role to existing ...

Terminalfour security vulnerabilities

Terminalfour is a digital marketing and web content management platform for higher education from US-based Terminalfour. A security vulnerability exists in Terminalfour versions 8 through 8.4.1.1 that stems from insufficient authorization checking of the userLevel parameter, which could result in...

CVE-2025-58386: Improper Authorization

In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new...

EUVD-2022-46954

Malicious code in bioql PyPI...

CVE-2022-47377

Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version = 1.13.4 as soon as possible available in SICK Support Portal...

CVE-2022-47377

Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version = 1.13.4 as soon as possible available in SICK Support Portal...

CVE-2022-27584

Password recovery vulnerability in SICK SIM2000ST Partnumber 1080579 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby...

CVE-2022-27585

Password recovery vulnerability in SICK SIM1000 FX Partnumber 1097816 and 1097817 with firmware version = 1.6.0 as soon as possible available in SICK Support Portal...

CVE-2022-27586

Password recovery vulnerability in SICK SIM1004 Partnumber 1098148 with firmware version = 2.0.0 as soon as possible available in SICK Support Portal...

Design/Logic Flaw

Password recovery vulnerability in SICK SIM1004 Partnumber 1098148 with firmware version = 2.0.0 as soon as possible available in SICK Support Portal...

Design/Logic Flaw

Password recovery vulnerability in SICK SIM2000ST Partnumber 1080579 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby...

CVE-2022-27585

Password recovery vulnerability in SICK SIM1000 FX Partnumber 1097816 and 1097817 with firmware version = 1.6.0 as soon as possible available in SICK Support Portal...

CVE-2022-43989

Password recovery vulnerability in SICK SIM2x00 ARM Partnumber 1092673 and 1081902 with firmware version = 1.2.0 as soon as possible available in SICK Support Portal...

CVE-2022-43990

The CVE-2022-43990 entry affects SICK SIM1012 Partnumber 1098146 with firmware versions prior to 2.2.0. It permits an unprivileged remote attacker to invoke the password recovery mechanism to gain the RecoverableUserLevel, increasing privileges and impacting confidentiality, integrity, and availa...

CVE-2022-27586

The CVE-2022-27586 issue affects SICK SIM1004 Partnumber 1098148 with firmware versions prior to 2.0.0. The vulnerability is a password recovery mechanism flaw that allows an unprivileged, remote attacker to invoke password recovery and gain access at the RecoverableUserLevel, leading to elevated...

CVE-2022-43989

The CVE-2022-43989 entry affects SICK SIM2x00 devices (ARM) with Partnumbers 1092673 and 1081902, on firmware versions older than 1.2.0. The vulnerability arises from a flaw in the password recovery mechanism that allows an unprivileged remote attacker to invoke password recovery and obtain acces...

CVE-2022-27584

The CVE-2022-27584 entry describes a password recovery vulnerability in SICK SIM2000ST (Partnumber 1080579) where an unprivileged, remote attacker can invoke the password recovery mechanism to gain access at RecoverableUserLevel, increasing privileges and impacting confidentiality, integrity, and...

CVE-2020-19165

PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevelid=1 userlevelid parameter...

PT-2020-15170

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description The issue is related to SQL injection via the "admin.php?mod=user&userlevel id=1" API endpoint, specifically through the userlevel id parameter. This allows for potential exploitation. Recommendations For PHPSHE...