CVE-2025-68721

CVE-2025-68721: Axigen WebAdmin 액세스 제어 취약점 취약점 요약 권한 논리의 결함으로 인해 권한이 전혀 없는 관리자 계정이 "Security & Filtering" 페이지, 특히 SSL 인증서 엔드포인트에 접근할 수 있습니다. 다른 제한된 섹션은 올바르게 차단되지만, 이 엔드포인트는 권한 없는 접근이 허용된 채로 남습니다. 영향받는 버전: 10.6.26 자세한 내용은 Axigen 기술 자료를 참조하십시오. POC 대상 URL:...

PT-2026-58869

Name of the Vulnerable Software and Affected Versions Grav Flex Objects Plugin versions prior to 1.4.3 Description An issue exists where the requireFlexPermission function in classes/Api/FlexApiController.php fails to deny access when a directory blueprint omits config.admin.permissions. This...

Snipe-IT's selectlist visibility is too permissive

Impact The GET /api/v1/object/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This...

CVE-2026-54318 Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services...

CVE-2025-68400

ChurchCRM prior to v6.5.3 is affected by a SQL Injection in the legacy endpoint /Reports/ConfirmReportEmail.php. The issue arises from an unvalidated familyId parameter in a historically removed UI feature that remains reachable directly (dead but reachable code). Any authenticated user, even wit...

CVE-2023-34165

Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions...

CVE-2023-34165

Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions...

CVE-2023-34165

Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions...

Design/Logic Flaw

Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions...

CVE-2023-34165: Missing Authorization

Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions...

Android new attack: Google Voice Search attack-vulnerability warning-the black bar safety net

Chinese University of Hong Kong researchers in the Preprint posted on the website of paper PDF, describes a novel permission to bypass attack method: Google Voice Search attack. An attacker can leverage a zero-permissions Android app VoicEmployer, front activationoperating system built-in voice...