CVE-2026-29195: Incorrect Authorization

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler PUT /api/users/username lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code correctly blocks an admin from assigning the admin role to...

CVE-2026-20139: Uncontrolled Resource Consumption

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload into the...

Core FTP 安全漏洞

Core FTP is a file transfer server. Core FTP LE v2.2 allows local attackers to cause a denial or service A security vulnerability exists that allows local attackers to cause a denial of service via a long string in Settings-Users-Username editbox...

CVE-2006-1207: Undefined Security Weakness

PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/USERNAME file...

CVE-2006-1209: Undefined Security Weakness

PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/USERNAME file...

CVE-2006-0103: Exposure of Sensitive Information to an Unauthorized Actor

TinyPHPForum 3.6 and earlier stores the 1 users/USERNAME.hash and 2 users/USERNAME.email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information...