Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance end…
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other memb…
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigControll…
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent…
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in Storag…
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Att…
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attac…
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permissi…
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_…
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attac…
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA…
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can …
Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can …
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. …
Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name o…
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present…
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authent…
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from…
Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Configured Access Control Secur…
Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pr…