CWE-639

Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream servi

Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade

TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-

A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects s

Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Softwa

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious use

A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the fi

Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unautho

Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing

Authorization Bypass Through User-Controlled Key vulnerability in Vidco Software VOC TESTER allows Forceful Browsing. T

Authorization Bypass Through User-Controlled Key vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Inco

Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Pri

Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew. The issue was fixed in version JUN23 #190.

The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Feature

Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incor

A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue

A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /

Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated att

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that

A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src

Authorization Bypass Through User-Controlled Key vulnerability in Equalize Digital Accessibility Checker by Equalize Dig

Authorization Bypass Through User-Controlled Key vulnerability in Sayful Islam Upcoming Events Lists upcoming-events-lis

The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,

When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely identify

The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and inc

The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in

Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Inco

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allow

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Inco

The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up

Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia ameliabooking allows Exploiting I

A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 1

The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Di

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln

A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This

An unauthenticated attacker can infer the existence of usernames in the system by querying an API.

An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").

An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").

An unauthenticated attacker can obtain a user's plant list by knowing the username.

An unauthenticated attacker can check the existence of usernames in the system by querying an API.

An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.

An authenticated attacker can obtain any plant name by knowing the plant ID.

Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).

An attacker can export other users' plant information.