NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated...
CVE-2026-117606
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate ot
#cwe-639
共收录 1905 条相关情报。
← 返回所有主题GROWI contains an authorization bypass vulnerability in its tag update API and the page update...
CVE-2026-109848
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use o
GROWI contains an authorization bypass vulnerability in its page viewing and commenting...
CVE-2026-105272
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper us
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersServ...
CVE-2026-117606
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate ot
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAdd...
CVE-2026-117605
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAd
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability...
CVE-2026-109848
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use o
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerabil...
CVE-2026-105272
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper us
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfig...
CVE-2026-116672
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientC
Authlib RFC 7592 examples omit registration-access-token client binding
CVE-2026-116672
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientC
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This ...
CVE-2026-16307
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessi
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share se...
CVE-2026-117563
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows aut
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publ...
CVE-2026-117562
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article ...
CVE-2026-116899
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices i
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authen...
CVE-2026-116898
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated...
CVE-2026-116810
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace...
CVE-2026-2270
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview...
CVE-2026-116746
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX
QloApps through 1.7.0 contains an information disclosure vulnerability in...
CVE-2026-116745
QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allow
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create ...
CVE-2026-2270
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit r...
CVE-2026-116746
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX