Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator.
This issue affects Hitachi Ops Center Administrator: before 11.0.9-01.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. The…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath.…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps__start and steps__load_step routes…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcements…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
CVSS
4,3
EPSS
0,2 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator.
This issue affects Hitachi Ops Center Administrator: before 11.0.9-01.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. The…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps__start and steps__load_step routes…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcements…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
4,3
0,2 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.