Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip audit permission checks and multi-level approval workflows,…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver checks are commented out, letting…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Access Control. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt templates by calling DELETE /airag/prompts/delete. Low-privileged attackers can obtain template ids from the unguarded GET /airag/prompts/list…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatch…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
CVSS
5,3
EPSS
0,2 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip audit permission checks and multi-level approval workflows,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver checks are commented out, letting…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Access Control. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt templates by calling DELETE /airag/prompts/delete. Low-privileged attackers can obtain template ids from the unguarded GET /airag/prompts/list…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatch…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
5,3
0,2 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.