SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate
CVE-2026-108713
SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated
#advisory
共收录 23075 条相关情报。
← 返回所有主题SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point
CVE-2026-108712
SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that
Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces
CVE-2026-108711
Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped
BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization
CVE-2026-108574
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs
Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery
CVE-2026-108572
A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate
InstantSoft icms2 Image image.php files_delete_file path traversal
CVE-2026-108567
A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file syst
InstantSoft icms2 Private Message index.tpl.php index cross site scripting
CVE-2026-108566
A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file temp
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect...
CVE-2026-108707
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthentic
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because...
CVE-2026-108708
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every ca
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is...
CVE-2026-108521
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemot
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated...
CVE-2026-108694
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server fil
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the...
CVE-2026-108701
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule ha
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability...
CVE-2026-108695
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accoun
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form...
CVE-2026-108705
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint tha
ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path...
CVE-2026-108693
ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscrip
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the...
CVE-2026-108706
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allo
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged...
CVE-2026-108704
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that...
CVE-2026-108696
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated c
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource...
CVE-2026-108703
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authe
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval...
CVE-2026-108702
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowin