CWE-266: CWE-266

TeamPass versions before 3.1.3.1 contain an authorization bypass vulnerability where users can access folder information without proper permission che...

This CVE describes an Insecure Direct Object Reference (IDOR) vulnerability in SourceCodester Hospital Management System 1.0. Attackers can remotely d...

This CVE describes an improper authorization vulnerability in Sanluan PublicCMS's trade payment handler. Attackers can manipulate payment IDs to bypas...

This vulnerability in CyberArk's Password Vault Web Access (PVWA) allows potential privilege escalation through LDAP mapping misconfiguration. It affe...

This PostgreSQL vulnerability allows a less-privileged application user to view or modify unintended database rows when the application uses SET ROLE ...

This vulnerability allows telemetry opt-in settings corruption on other Pixel Watches when setting up a new watch, potentially enabling local privileg...

This vulnerability allows an Android app to launch the ChooserActivity in another user profile without proper authorization due to improper input vali...

This CVE describes a tapjacking/overlay vulnerability in Android's biometric authentication system that allows attackers to overlay legitimate biometr...

This CVE describes a permission squatting vulnerability in Android's RoleService that allows local privilege escalation on affected versions. It affec...

This CVE describes an improper authorization vulnerability in JeecgBoot's getPositionUserList function. Attackers can manipulate the positionId parame...

This vulnerability in JeecgBoot allows attackers to bypass authorization checks by manipulating the departId parameter in the /sys/sysDepartPermission...

This CVE describes an improper authorization vulnerability in JeecgBoot's queryDepartPermission function. Attackers can manipulate the departId parame...

JeecgBoot up to version 3.9.0 contains an improper authorization vulnerability in the /sys/sysDepartPermission/datarule/ endpoint. This allows remote ...

This CVE describes an improper authorization vulnerability in JeecgBoot's loadDatarule function that allows attackers to manipulate departId/roleId pa...

This CVE describes an improper authorization vulnerability in JeecgBoot's getDeptRoleList function. Attackers can manipulate the departId parameter to...

This vulnerability in JeecgBoot allows attackers to bypass authorization checks by manipulating the deptId parameter in the /sys/sysDepartRole/list en...

This vulnerability in youlaitech youlai-mall allows attackers to bypass access controls in the order payment function, potentially manipulating paymen...

This vulnerability allows Keycloak administrators with limited privileges to access sensitive custom user attributes that should be hidden by User Pro...