#cwe-602

共收录 70 条相关情报。

漏洞预警2026-10-27 发布INFO

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when...

CVE-2026-117554

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register ev

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

安全公告2026-10-27 发布INFO

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element...

CVE-2026-116605

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-602 #severity:medium

漏洞预警2026-10-27 发布MEDIUM

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument ...

CVE-2026-116605

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function

来源摘录 · NVD

#cve #cwe-602

漏洞预警2026-10-13 发布INFO

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify...

CVE-2026-89206

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perfor

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

漏洞预警2026-10-13 发布INFO

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedu...

CVE-2026-89205

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perfor

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

漏洞预警2026-10-13 发布INFO

Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects...

CVE-2026-13138

Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketin

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

漏洞预警2026-09-15 发布INFO

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the or...

CVE-2026-82189

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-472 #cwe-602

漏洞预警2026-09-11 发布INFO

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in ...

CVE-2026-54047

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior t

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-349 #cwe-602

漏洞预警2026-09-11 发布INFO

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authenticat...

CVE-2026-89175

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

漏洞预警2026-09-03 发布INFO

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal I...

CVE-2026-77999

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Sto

历史摘要 · 未重新核验 · NVD

#cve #cwe-472 #cwe-602

安全公告2026-09-02 发布INFO

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability...

CVE-2026-84841

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The m

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-602 #severity:medium

漏洞预警2026-09-02 发布INFO

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-...

CVE-2026-84841

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The m

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

安全公告2026-09-02 发布INFO

tsi-coop tsi-dpdp-cms client-side enforcement of server-side security

CVE-2026-84841

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The m

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-602

漏洞预警2026-09-02 发布INFO

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid reg...

CVE-2026-77793

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-si

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

漏洞预警2026-09-01 发布INFO

A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulation results in cli...

CVE-2026-84110

A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

安全公告2026-08-26 发布INFO

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

CVE-2026-54553

## Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-200 #cwe-248 #cwe-602 #cwe-639

漏洞预警2026-08-21 发布INFO

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can explo...

CVE-2026-73267

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissi

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

漏洞预警2026-08-20 发布INFO

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access control. An unauthe...

CVE-2026-77026

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Su

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

漏洞预警2026-08-19 发布INFO

MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign_up in webserver/handlers/user.py does not...

CVE-2026-45274

MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

漏洞预警2026-08-19 发布INFO

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a clien...

CVE-2026-67363

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-472 #cwe-602