Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned role permits.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.23.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoints…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role can call the affected endpoints to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to modify, altering records without proper…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.
We have already fixed the vulnerability in the following version:
QuRouter 2.7.2.113 and later
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause heap data disclosure via a malformed UPDATE sent over a session with the traffic-engineering address…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
CVSS
5,3
EPSS
0,19 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned role permits.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.23.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoints…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role can call the affected endpoints to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to modify, altering records without proper…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.
We have already fixed the vulnerability in the following version:
QuRouter 2.7.2.113 and later
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause heap data disclosure via a malformed UPDATE sent over a session with the traffic-engineering address…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
5,3
0,19 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.