Parse Server versions before 8.6.100 and from 9.0.0 up to but not including 9.10.4 allow clients to write reserved internal field names in object writes. This vulnerability enables attackers to disrupt object reads on MongoDB by injecting reserved fields, affecting all users querying that class. Additionally, attackers can clear their own account lockout state and password history, bypassing lockout and password policies.
Parse Server versions before 8.6.102 and from 9.0.0 up to but not including 9.10.5 contain an authentication bypass vulnerability. This occurs because custom AuthAdapter subclasses do not have their validateSetUp, validateLogin, and validateUpdate methods called, causing the system to fall back to a default that accepts any authentication data. This flaw allows attackers to supply arbitrary authentication data to sign up, link identities, log in as existing users, or bypass additional authentication factors.
Parse Server versions before 8.6.104 and 9.0.0 before 9.10.5 contain a privilege escalation vulnerability in the SMS multi-factor authentication (MFA) login process. The server saves the entire login request with master privileges when issuing an SMS MFA verification code. This allows an SMS MFA-enrolled user to modify master-key-restricted fields on their own account, such as the email-verification flag or values protected by beforeSave triggers.
Parse Server versions before 8.6.103 and from 9.0.0 up to but not including 9.10.5 contain an information disclosure vulnerability in the LiveQuery feature. The issue arises because the subscription hash omits constraints adjacent to a $or operator, causing distinct subscriptions to be grouped incorrectly. This allows authenticated clients using $or queries to receive events intended for other users, including session tokens that could be used for impersonation.
RT's automatic link creation for URLs in HTML ticket content does
not HTML-escape the URL it places in the link. A URL crafted to
break out of the link's address can add a script that runs when the
ticket history is displayed, with no further action by the viewer.
Anyone who can add HTML content to a ticket can plant it. That
includes an unauthenticated sender of HTML email to any queue that
grants CreateTicket or ReplyToTicket to Everyone, which is routine
for a queue that accepts mail from the public. The script runs in
the session of any user who views the ticket, and can act in RT
with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
RTIR's ticket creation forms show the subject of the related
ticket when splitting a ticket or creating an incident from a
report, and they render that subject without HTML escaping. A
ticket subject containing script runs it when a user opens either
form. RTIR grants everyone the right to create Incident Reports by
default, so an unauthenticated sender of an emailed report can set
that subject. The script then runs in the session of the incident
handler who creates an incident from the report or splits it, and
can act in RT with that user's authority.
The issue was fixed in version 6.0.4. RTIR 5.0 is not
affected.
A stored cross-site scripting (XSS) vulnerability exists in the Blocksy Companion plugin for Creative Themes, affecting versions up to 2.1.60. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges and requiring user interaction to execute malicious scripts in the context of the affected application. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A deserialization of untrusted data vulnerability exists in the SubWorkflow task of Google Cloud Application Integration versions prior to 2026-09-11. This flaw allows an authenticated attacker to execute arbitrary code by submitting a maliciously crafted serialized object. The vulnerability was patched on September 11, 2026, and no customer action is required.
An improper access control vulnerability in the multi-factor authentication (MFA) feature of ManageEngine SharePoint Manager Plus (SPMP) allows a low-privileged authenticated user to bypass authorization checks. This enables reading and modifying MFA settings, enabling or disabling MFA, enumerating MFA-enrolled users, and deleting MFA-enrolled accounts. Exploitation could weaken authentication protections or cause denial of service by locking out legitimate users. The issue was fixed in build 4507; the vulnerability was demonstrated in build 4506.
Tamery versions from 0.26.1 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's chatsMessages.update handler. This flaw allows authenticated Pro subscribers to modify another user's AI chat history by moving messages with arbitrary content if they know the victim's chat ID. The vulnerability impacts message integrity but does not affect confidentiality or availability.
WHartTest versions 2.2.0 through 2.8.1 have a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet. Authenticated users can exploit this flaw by setting the project_pk parameter to another project's ID, enabling them to access, modify, delete, or trigger scheduled tasks and read execution logs of other projects.
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. This allows attackers to inject malicious HTML or JavaScript into attributes used for generating charts, such as users' full names, site names, or group names. The malicious content is stored and executed in the browsers of other users viewing the affected charts. The vulnerability was fixed in client application build 4508.
Tamery versions from 0.32.0 up to but not including 0.99.0 contain a broken authorization vulnerability in the cloud sync API's connectionsResources.create handler. This flaw allows authenticated users to attach resources to other users' connections by including a victim's connectionId in a batch request. The vulnerability results in unauthorized resource insertion under a victim's connection context.
Songloft versions from 2.9.0 up to but not including 2.13.6 contain a hardcoded credentials vulnerability. This flaw allows attackers on the same network segment to authenticate as an administrator using a fixed username and password (admin/admin). Exploiting this vulnerability enables unauthorized modification of library and configuration settings and installation of JavaScript plugins executed in QuickJS.
Blossom through version 1.17.1 has an authorization bypass vulnerability that allows authenticated users to access and manipulate other users' folders. This occurs because the FolderService queries only filter by folder ID, enabling attackers to supply another user's folder ID to endpoints like /folder/info, /folder/upd, /folder/open, or /folder/del. As a result, attackers can read storage paths, rename folders, toggle visibility, or delete folders belonging to other users.
CoreShop by CoreUnion versions through 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint. The flaw allows anonymous attackers to inject subqueries via the order parameter, bypassing SqlSugar's field validation. This can lead to extraction of member account and order data using boolean-based or time-based blind SQL injection techniques.
PowerDNS-Admin versions up to 2026.08.1 have an authorization bypass vulnerability. Authenticated users with User-role privileges can refresh secondary DNS zones they are not authorized to access by manipulating the 'domain' field in the JSON request body. This allows attackers with access to any one zone to trigger zone transfers (axfr-retrieve) of other users' secondary zones and potentially infer the existence of those zones based on response differences.
MuseBot versions before 2.0.0 have an authentication bypass vulnerability due to a hard-coded default session key. This flaw allows unauthenticated attackers to forge admin sessions by signing a session cookie with the known default key. Successful exploitation grants full administrative access, including reading password hashes, chat records, bot configuration, and the ability to stop bots.
FilePress versions through 3.0.1 have a missing authorization vulnerability in the dzz/pichome/library component. This flaw allows authenticated users to manage folders in other libraries because the permission check only verifies membership in any library, not the specific target library. Attackers who know another library's appid or folder id can perform operations such as deleting, renaming, or reading folders they do not own.
ShowDoc versions through 3.9.5 have an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint. The endpoint only verifies edit permission for the first entry ID supplied, allowing authenticated attackers to delete parameter-description entries belonging to other users by manipulating the order of entry IDs in the request.