107,314 results · Clear filters · Feed
-
Medium 6.1
CVE-2026-103523
Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Becau…
-
Medium 5.3
Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine
A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is po…
-
Medium 5.3
LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet
LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numer…
-
Medium 6.3
LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any…
-
Medium 6.5
LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version paramet…
-
Medium 6.5
LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restrict…
-
Medium 6.4
LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href
LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose sty…
-
Medium 6.5
LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean H…
-
Medium 6.5
LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in th…
-
Medium 5.9
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core's default HTTP adapter on Erlang/OTP …
-
Medium 6.3
BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization
A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The mani…
-
Medium 4.3
jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints
jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add…
-
Medium 6.5
jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey
jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant can request arbitrar…
-
Medium 4.3
jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GE…
-
Medium 4.3
jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip audit permission che…
-
Medium 4.3
jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel
jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export…
-
Medium 4.3
jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON …
-
Medium 4.3
jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name…
-
Medium 4.3
jshERP through 3.6 Missing Authorization via /log/list and /log/info
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login name…
-
Medium 5.4
jshERP through 3.6 Missing Authorization via /log Audit Endpoints
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabri…
-
Medium 4.3
MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/mov…
-
Medium 5.4
MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's f…
-
Medium 4.3
MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only b…
-
Medium 6.5
MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig
MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemCo…
-
Medium 4.3
yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check a…
-
Medium 4.3
yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver …
-
Medium 4.3
yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver …
-
Medium 4.3
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential…
-
Medium 6.5
lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file …
-
Medium 6.5
lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById h…
-
Medium 4.3
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create
TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form…
-
Medium 4.4
Yungengxin Cloud Billing IOCTL Process Termination LWBilling64.sys sub_14000443C exposed ioctl with insufficient access control
A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub_14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to e…
-
Medium 4.0
Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker…
-
Medium 6.5
Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated at…
-
Medium 4.4
Yungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges management
A flaw has been found in Yungengxin Yun Jia Security Guard up to 2.7.1.9. Impacted is the function sub_14000885C in the library kgameprotect.sys. Executing a manipulation of the argument Pid can lead to improper privilege management. The attack requires local…
-
Medium 4.3
Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting
A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The atta…
-
Medium 4.6
RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver
RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes…
-
Medium 6.5
LavaLite CMS through 10.1.2 Authorization Bypass via User Update API
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update …
-
Medium 5.3
Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes
Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUI…
-
Medium 6.3
meetecho janus-gateway Admin API admin.js hard-coded credentials
A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed…