Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the q URL parameter in the /api/v2.0/users endpoint. An attacker can retrieve sensitive password hash and salt values by abusing the filtering capability to extract this information character by character. Note:...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the q URL parameter in the /api/v2.0/users endpoint. An attacker can retrieve sensitive password hash and salt values by abusing the filtering capability to extract this information character by character. Note:...

Harbor 安全漏洞

Harbor is an open source registry from Harbor Open Source. Artifacts are protected through policies and role-based access control, ensuring that images are scanned and are not vulnerable, and signing images as trusted. A security vulnerability exists in Harbor versions prior to 2.13.1 and prior t...

SUSE CVE-2025-3580

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator...

CVE-2023-0872

The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizo...

CVE-2023-1562

Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner...

PT-2025-16787 · Sourcecodester · Sourcecodester Online Id Generator System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online ID Generator System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability. This is achieved through the id...

PT-2025-13393 · Unknown · Hay-Kot Mealie

Name of the Vulnerable Software and Affected Versions: hay-kot mealie version 2.2.0 Description: A Broken Object Level Authorization vulnerability in the component "/api/users/user-id" of hay-kot mealie allows users to edit their own profile in order to give themselves more permissions or to chan...

PT-2025-12318

Name of the Vulnerable Software and Affected Versions BerriAI/litellm version main-latest Description The issue is related to improper authorization. When a user with the role internal user viewer logs into the application, they are provided with an overly privileged API key. This key allows acce...

U.S. Dept Of Defense: Information Disclosure in API Endpoint /users

An endpoint /users was exposing sensitive user information, including id, first name, last name, email, role, and authdata, to unauthenticated users. This allowed anyone to retrieve private user details without authentication...

Incorrect Access Control

letta is vulnerable to Incorrect Access Control. The vulnerability is due to improper enforcement of access controls in the /users endpoint, allowing attackers to access sensitive data...

Missing Authorization

Overview letta is a Create LLM agents with long-term memory and custom tools Affected versions of this package are vulnerable to Missing Authorization on the /users endpoint, which does not check for authorization before returning data from the getallusers function. Remediation Upgrade letta to...

PT-2024-28335

Name of the Vulnerable Software and Affected Versions Cpacker MemGPT version 0.3.17 Description The issue is related to incorrect access control in the "/users" endpoint, allowing attackers to access sensitive data. Recommendations For version 0.3.17, consider disabling access to the "/users"...

CVE-2024-54927

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deleteusers.php...

InfoDom Performa 安全漏洞

InfoDom Performa is a digital platform for change management from InfoDom. A security vulnerability exists in InfoDom Performa version 365 4.0.1, which stems from a vulnerability that allows authenticated attackers to elevate their privileges via a specially crafted payload sent to /api/users...

CVE-2024-50671

Incorrect access control in Adapt Learning Adapt Authoring Tool = 0.11.3 allows attackers with Authenticated User roles to obtain email addresses via the "Get users" feature. The vulnerability occurs due to a flaw in permission verification logic, where the wildcard character in permitted URLs...

PT-2024-34489 · Unknown · Phpgurukul User Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul User Management System version 1.0 Description: A Cross Site Scripting XSS issue was found in the "/ums-sp/admin/registered-users.php" endpoint, allowing remote attackers to execute arbitrary code via the fname POST request...

PT-2024-38366 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version v1.4.2 Description: A SQL injection vulnerability exists in the "/api/v1/external-users" route. The order by clause of the SQL query uses sql.unsafe without prior sanitization, allowing for SQL injection. The...

PT-2024-30147 · Unknown · Kashipara Hotel Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Hotel Management System version 1.0 Description: The issue is related to Incorrect Access Control. It can be exploited via the "/admin/users.php" API endpoint. There is no information provided about the estimated number of potential...

CVE-2024-7297

Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint...