waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints
CVE-2026-110125
Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members
#advisory
共收录 23043 条相关情报。
← 返回所有主题FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints
CVE-2026-110124
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authent
Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints
CVE-2026-110123
Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to
PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint
CVE-2026-110122
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated selle
PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint
CVE-2026-110121
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated selle
WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
CVE-2026-110118
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complet
SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController
CVE-2026-110117
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authentic
Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile
CVE-2026-110116
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager store
Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream
CVE-2026-110115
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileCo
oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints
CVE-2026-110114
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to dele
PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
CVE-2026-110113
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController t
JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints
CVE-2026-110110
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query acces
JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save
CVE-2026-110109
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query acces
MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API
CVE-2026-110108
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage obje
RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
CVE-2026-110107
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated user
RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
CVE-2026-110106
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users
B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes
CVE-2026-110105
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to rea
novel through 3.5.0 Unsalted MD5 Password Storage
CVE-2026-110104
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext pa
bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type
CVE-2026-110103
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML
powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
CVE-2026-110102
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables T