Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting. Attackers with the Raven User role can call the join_workspace method to become persistent members,…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. The vendor was…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
CVSS
5,3
EPSS
0,22 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting. Attackers with the Raven User role can call the join_workspace method to become persistent members,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. The vendor was…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
5,3
0,22 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.