PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint
CVE-2026-110122
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated selle
#cwe-639
共收录 1905 条相关情报。
← 返回所有主题PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint
CVE-2026-110121
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated selle
WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
CVE-2026-110118
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complet
PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
CVE-2026-110113
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController t
RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
CVE-2026-110107
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated user
RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
CVE-2026-110106
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users
Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests
CVE-2026-110098
Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/...
CVE-2026-102981
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers ...
CVE-2024-34323
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogi
OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
CVE-2026-54641
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealm
Plane: Unauthenticated Workspace Invitation Token Leakage
CVE-2026-102981
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyi...
CVE-2026-109963
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_tem
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by sup...
CVE-2026-109957
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Im
Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
CVE-2026-109963
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_tem
EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter
CVE-2026-109957
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Im
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management....
CVE-2026-89204
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restri
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests....
CVE-2026-89202
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perfor
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific d...
CVE-2026-89199
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restri
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the compon...
CVE-2026-109116
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authentica...
CVE-2026-109675
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in th