Paymenter has broken object level authorization via service reference manipulation on ticket creation
CVE-2026-44585
### Summary The ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validati
#cwe-862
共收录 4228 条相关情报。
← 返回所有主题A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine...
CVE-2026-8934
A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud C
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated...
CVE-2026-56104
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and i
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions
CVE-2026-33684
## Summary The `set_api_signUp` method in the API plugin accepts `emailVerified`, `canUpload`, `canStream`, and `canCre
A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak ...
CVE-2026-8934
A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud C
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid ...
CVE-2026-56104
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and i
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administrator authorization on the {{setDefaultInstance}} call with...
CVE-2026-5139
Mattermost versions 11.7.x }} slash command.. Mattermost Advisory ID: MMSA-2026-00644
MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing o...
CVE-2026-56424
MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong ent
MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using...
CVE-2026-56423
MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The af
Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restri...
CVE-2026-44914
Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension componen
The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers to modify arbitrary...
CVE-2026-7859
The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX action
phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and...
CVE-2026-56396
phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that
Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A...
CVE-2026-56384
Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user with
phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privilege...
CVE-2026-56396
phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that
Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call th...
CVE-2026-56384
Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user with
AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment...
CVE-2026-56341
AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authori
AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webh...
CVE-2026-56341
CVE-2026-56341 影响 AVideo 平台版本 26.0 及更早版本，其支付插件中存在多个未认证的 list.json.php 端点，这些端点缺乏必要的授权检查，导致攻击者无需任何凭证即可通过直接 GET 请求访问敏感数据。具体
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a...
CVE-2026-12119
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization c
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to...
CVE-2026-11912
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all vers...
CVE-2026-12119
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization c