An improper access control vulnerability in the multi-factor authentication (MFA) feature of ManageEngine SharePoint Manager Plus (SPMP) allows a low-privileged authenticated user to bypass authorization checks. This enables reading and modifying MFA settings, enabling or disabling MFA, enumerating MFA-enrolled users, and deleting MFA-enrolled accounts. Exploitation could weaken authentication protections or cause denial of service by locking out legitimate users. The issue was fixed in build 4507; the vulnerability was demonstrated in build 4506.
Tamery versions from 0.26.1 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's chatsMessages.update handler. This flaw allows authenticated Pro subscribers to modify another user's AI chat history by moving messages with arbitrary content if they know the victim's chat ID. The vulnerability impacts message integrity but does not affect confidentiality or availability.
WHartTest versions 2.2.0 through 2.8.1 have a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet. Authenticated users can exploit this flaw by setting the project_pk parameter to another project's ID, enabling them to access, modify, delete, or trigger scheduled tasks and read execution logs of other projects.
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. This allows attackers to inject malicious HTML or JavaScript into attributes used for generating charts, such as users' full names, site names, or group names. The malicious content is stored and executed in the browsers of other users viewing the affected charts. The vulnerability was fixed in client application build 4508.
Tamery versions from 0.32.0 up to but not including 0.99.0 contain a broken authorization vulnerability in the cloud sync API's connectionsResources.create handler. This flaw allows authenticated users to attach resources to other users' connections by including a victim's connectionId in a batch request. The vulnerability results in unauthorized resource insertion under a victim's connection context.
Songloft versions from 2.9.0 up to but not including 2.13.6 contain a hardcoded credentials vulnerability. This flaw allows attackers on the same network segment to authenticate as an administrator using a fixed username and password (admin/admin). Exploiting this vulnerability enables unauthorized modification of library and configuration settings and installation of JavaScript plugins executed in QuickJS.
Blossom through version 1.17.1 has an authorization bypass vulnerability that allows authenticated users to access and manipulate other users' folders. This occurs because the FolderService queries only filter by folder ID, enabling attackers to supply another user's folder ID to endpoints like /folder/info, /folder/upd, /folder/open, or /folder/del. As a result, attackers can read storage paths, rename folders, toggle visibility, or delete folders belonging to other users.
CoreShop by CoreUnion versions through 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint. The flaw allows anonymous attackers to inject subqueries via the order parameter, bypassing SqlSugar's field validation. This can lead to extraction of member account and order data using boolean-based or time-based blind SQL injection techniques.
PowerDNS-Admin versions up to 2026.08.1 have an authorization bypass vulnerability. Authenticated users with User-role privileges can refresh secondary DNS zones they are not authorized to access by manipulating the 'domain' field in the JSON request body. This allows attackers with access to any one zone to trigger zone transfers (axfr-retrieve) of other users' secondary zones and potentially infer the existence of those zones based on response differences.
MuseBot versions before 2.0.0 have an authentication bypass vulnerability due to a hard-coded default session key. This flaw allows unauthenticated attackers to forge admin sessions by signing a session cookie with the known default key. Successful exploitation grants full administrative access, including reading password hashes, chat records, bot configuration, and the ability to stop bots.
FilePress versions through 3.0.1 have a missing authorization vulnerability in the dzz/pichome/library component. This flaw allows authenticated users to manage folders in other libraries because the permission check only verifies membership in any library, not the specific target library. Attackers who know another library's appid or folder id can perform operations such as deleting, renaming, or reading folders they do not own.
ShowDoc versions through 3.9.5 have an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint. The endpoint only verifies edit permission for the first entry ID supplied, allowing authenticated attackers to delete parameter-description entries belonging to other users by manipulating the order of entry IDs in the request.
HuLa-Server versions through 3.0.7 have an insecure direct object reference (IDOR) vulnerability in the PrivacyController. Authenticated users can exploit this flaw by supplying another user's uid in GET or POST requests to the /privacy endpoint, allowing them to read and overwrite that user's privacy settings without proper ownership verification.
Nging through 5.3.5 has an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the /user/autocomplete_path endpoint. Low-privileged users without file-manager permissions can supply arbitrary paths to enumerate directories readable by the Nging process and confirm the existence of specific files.
HuLa-Server versions up to 3.0.7 have an insecure direct object reference (IDOR) vulnerability in the FriendController.friendList endpoint. Authenticated users can exploit this flaw by supplying a uid parameter in GET requests to /user/friend/page, allowing them to view other users' friend lists without proper authorization checks. This vulnerability exposes user contact lists to unauthorized access.
HuLa-Server versions through 3.0.7 have an insecure direct object reference (IDOR) vulnerability in the FeedController.delFeed function. Authenticated users can exploit this flaw by sending POST requests with arbitrary feedId values to delete other users' moments, including associated media, comments, and likes. This vulnerability allows unauthorized deletion of content without proper access control checks.
DataCap versions through 2025.1.1 have a missing authorization vulnerability that allows any authenticated user, including self-registered accounts, to escalate privileges. By sending PUT requests to the /api/v1/user/allocationRole endpoint, attackers can assign themselves the administrator role and gain full control of the instance.
CoreShop versions through 1.5.5 have an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint. The flaw arises from an unvalidated 'order' parameter that is appended directly to an ORDER BY clause, allowing attackers to inject subqueries. Exploitation can bypass SqlSugar's field validation and use blind SQL injection techniques to extract sensitive data such as member accounts and orders.
Orchard CMS versions 1.10.3 through 1.11 have an improper authorization vulnerability in the MediaLibraryService.CheckMediaFolderPermission() function. This flaw allows authenticated users with Author or Contributor roles to access media items belonging to other users. Exploitation enables attackers to display, clone, and delete other users' media by content ID and to delete arbitrary media folders via FolderController.Delete().
ZenTao PMS versions up to 22.6 have a missing authorization vulnerability in the doc::ajaxGetDoc() function. This flaw allows authenticated users with low privileges to bypass access checks and read private documents by enumerating document IDs. The vulnerability affects private documents and restricted libraries, products, projects, or team documents.