Common Weakness Enumeration
CWE-99
Allowed-with-ReviewImproper Control of Resource Identifiers ('Resource Injection')
Abstraction: Class · Status: Draft
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
117 vulnerabilities reference this CWE, most recent first.
CVE-2026-9438 (GCVE-0-2026-9438)
Vulnerability from cvelistv5 – Published: 2026-05-25 07:30 – Updated: 2026-05-26 14:01
VLAI
EPSS
VEX
Title
yashpokharna2555 StudentManagementSystem courseDel.php resource injection
Summary
A vulnerability was found in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file courseDel.php. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-26 13:58 UTC
CWE
- CWE-99 - Improper Control of Resource Identifiers
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/365419 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/365419/cti | signaturepermissions-required |
| https://vuldb.com/submit/813961 | third-party-advisory |
| https://github.com/yashpokharna2555/StudentManage… | exploitissue-tracking |
| https://github.com/yashpokharna2555/StudentManage… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| yashpokharna2555 | StudentManagementSystem |
Affected:
cb2f558ddf8d19396de0f92abf2d224d46a0a203
cpe:2.3:a:yashpokharna2555:studentmanagementsystem:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9438",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T13:58:15.227444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T14:01:09.377Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yashpokharna2555:studentmanagementsystem:*:*:*:*:*:*:*:*"
],
"product": "StudentManagementSystem",
"vendor": "yashpokharna2555",
"versions": [
{
"status": "affected",
"version": "cb2f558ddf8d19396de0f92abf2d224d46a0a203"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mortal (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file courseDel.php. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-25T07:30:11.550Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-365419 | yashpokharna2555 StudentManagementSystem courseDel.php resource injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/365419"
},
{
"name": "VDB-365419 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/365419/cti"
},
{
"name": "Submit #813961 | Yash Pokharna StudentManagementSystem 1.0 Insecure Direct Object Reference",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/813961"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/yashpokharna2555/StudentManagementSystem/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/yashpokharna2555/StudentManagementSystem/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-24T09:26:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "yashpokharna2555 StudentManagementSystem courseDel.php resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-9438",
"datePublished": "2026-05-25T07:30:11.550Z",
"dateReserved": "2026-05-24T07:21:07.198Z",
"dateUpdated": "2026-05-26T14:01:09.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7303 (GCVE-0-2026-7303)
Vulnerability from cvelistv5 – Published: 2026-04-28 19:00 – Updated: 2026-04-29 13:11 X_Open Source
VLAI
EPSS
VEX
Title
Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection
Summary
A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.4.0 is recommended to address this issue. The patch is identified as d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-29 13:10 UTC
CWE
- CWE-99 - Improper Control of Resource Identifiers
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/359959 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/359959/cti | signaturepermissions-required |
| https://vuldb.com/submit/803075 | third-party-advisory |
| https://github.com/xuxueli/xxl-job/issues/3936 | exploitissue-tracking |
| https://github.com/xuxueli/xxl-job/commit/d24e4cc… | patch |
| https://github.com/xuxueli/xxl-job/releases/tag/v3.4.0 | patch |
| https://github.com/xuxueli/xxl-job/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7303",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-29T13:10:12.102358Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-29T13:11:38.122Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:xuxueli:xxl-job:*:*:*:*:*:*:*:*"
],
"modules": [
"Execution Log Handler"
],
"product": "xxl-job",
"vendor": "Xuxueli",
"versions": [
{
"status": "affected",
"version": "3.3.0"
},
{
"status": "affected",
"version": "3.3.1"
},
{
"status": "affected",
"version": "3.3.2"
},
{
"status": "unaffected",
"version": "3.4.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "larlarua (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.4.0 is recommended to address this issue. The patch is identified as d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T19:00:17.015Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-359959 | Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/359959"
},
{
"name": "VDB-359959 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/359959/cti"
},
{
"name": "Submit #803075 | xuxueli https://github.com/xuxueli/xxl-job v3.3.2 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/803075"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/xuxueli/xxl-job/issues/3936"
},
{
"tags": [
"patch"
],
"url": "https://github.com/xuxueli/xxl-job/commit/d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a"
},
{
"tags": [
"patch"
],
"url": "https://github.com/xuxueli/xxl-job/releases/tag/v3.4.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/xuxueli/xxl-job/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-04-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-28T13:50:22.000Z",
"value": "VulDB entry last update"
}
],
"title": "Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-7303",
"datePublished": "2026-04-28T19:00:17.015Z",
"dateReserved": "2026-04-28T11:45:02.447Z",
"dateUpdated": "2026-04-29T13:11:38.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5414 (GCVE-0-2026-5414)
Vulnerability from cvelistv5 – Published: 2026-04-02 18:00 – Updated: 2026-04-02 18:41
VLAI
EPSS
VEX
Title
Newgen OmniDocs WebApiRequestRedirection resource injection
Summary
A security flaw has been discovered in Newgen OmniDocs up to 12.0.00. Affected by this issue is some unknown functionality of the file /omnidocs/WebApiRequestRedirection. The manipulation of the argument DocumentId results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-02 18:41 UTC
CWE
- CWE-99 - Improper Control of Resource Identifiers
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/354829 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/354829/cti | signaturepermissions-required |
| https://vuldb.com/submit/781765 | third-party-advisory |
| https://drive.google.com/file/d/1lYPiqFQd5JoZpIrI… | broken-linkexploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5414",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-02T18:41:33.926447Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:41:43.908Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OmniDocs",
"vendor": "Newgen",
"versions": [
{
"status": "affected",
"version": "12.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "kushkira (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Newgen OmniDocs up to 12.0.00. Affected by this issue is some unknown functionality of the file /omnidocs/WebApiRequestRedirection. The manipulation of the argument DocumentId results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:00:16.065Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-354829 | Newgen OmniDocs WebApiRequestRedirection resource injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/354829"
},
{
"name": "VDB-354829 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/354829/cti"
},
{
"name": "Submit #781765 | Newgen Software Newgen OmniDocs 12.0.00 Insecure Direct Object Reference",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/781765"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://drive.google.com/file/d/1lYPiqFQd5JoZpIrIh8ohD-7emzGSW0SV/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-02T10:07:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "Newgen OmniDocs WebApiRequestRedirection resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5414",
"datePublished": "2026-04-02T18:00:16.065Z",
"dateReserved": "2026-04-02T08:02:15.811Z",
"dateUpdated": "2026-04-02T18:41:43.908Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5031 (GCVE-0-2026-5031)
Vulnerability from cvelistv5 – Published: 2026-03-29 04:30 – Updated: 2026-04-01 14:27
VLAI
EPSS
VEX
Title
BichitroGan ISP Billing Software Endpoint users-view resource injection
Summary
A vulnerability was found in BichitroGan ISP Billing Software 2025.3.20. Impacted is an unknown function of the file /?_route=settings/users-view/ of the component Endpoint. The manipulation of the argument ID results in improper control of resource identifiers. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-01 14:27 UTC
CWE
- CWE-99 - Improper Control of Resource Identifiers
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/353953 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/353953/cti | signaturepermissions-required |
| https://vuldb.com/submit/778530 | third-party-advisory |
| https://github.com/4m3rr0r/PoCVulDb/issues/15 | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| BichitroGan | ISP Billing Software |
Affected:
2025.3.20
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5031",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-01T14:27:13.422129Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-01T14:27:38.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Endpoint"
],
"product": "ISP Billing Software",
"vendor": "BichitroGan",
"versions": [
{
"status": "affected",
"version": "2025.3.20"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "4m3rr0r (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in BichitroGan ISP Billing Software 2025.3.20. Impacted is an unknown function of the file /?_route=settings/users-view/ of the component Endpoint. The manipulation of the argument ID results in improper control of resource identifiers. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-29T04:30:11.668Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-353953 | BichitroGan ISP Billing Software Endpoint users-view resource injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/353953"
},
{
"name": "VDB-353953 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/353953/cti"
},
{
"name": "Submit #778530 | BichitroGan ISP Billing Software 2025.3.20 Insecure Direct Object Reference (IDOR) / Broken Access Control",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/778530"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/4m3rr0r/PoCVulDb/issues/15"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-27T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-27T17:11:04.000Z",
"value": "VulDB entry last update"
}
],
"title": "BichitroGan ISP Billing Software Endpoint users-view resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5031",
"datePublished": "2026-03-29T04:30:11.668Z",
"dateReserved": "2026-03-27T16:05:48.199Z",
"dateUpdated": "2026-04-01T14:27:38.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3693 (GCVE-0-2026-3693)
Vulnerability from cvelistv5 – Published: 2026-03-08 00:32 – Updated: 2026-03-11 16:27
VLAI
EPSS
VEX
Title
Shy2593666979 AgentChat User Endpoint user.py update_user_info resource injection
Summary
A flaw has been found in Shy2593666979 AgentChat up to 2.3.0. This issue affects the function get_user_info/update_user_info of the file /src/backend/agentchat/api/v1/user.py of the component User Endpoint. This manipulation of the argument user_id causes improper control of resource identifiers. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-11 16:26 UTC
CWE
- CWE-99 - Improper Control of Resource Identifiers
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.349640 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.349640 | signaturepermissions-required |
| https://vuldb.com/?submit.765589 | third-party-advisory |
| https://vuldb.com/?submit.765590 | third-party-advisory |
| https://github.com/CC-T-454455/Vulnerabilities/tr… | related |
| https://github.com/CC-T-454455/Vulnerabilities/tr… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Shy2593666979 | AgentChat |
Affected:
2.0
Affected: 2.1 Affected: 2.2 Affected: 2.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3693",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-11T16:26:40.504985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T16:27:34.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"User Endpoint"
],
"product": "AgentChat",
"vendor": "Shy2593666979",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2"
},
{
"status": "affected",
"version": "2.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Shy2593666979 AgentChat up to 2.3.0. This issue affects the function get_user_info/update_user_info of the file /src/backend/agentchat/api/v1/user.py of the component User Endpoint. This manipulation of the argument user_id causes improper control of resource identifiers. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-08T00:32:08.162Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-349640 | Shy2593666979 AgentChat User Endpoint user.py update_user_info resource injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.349640"
},
{
"name": "VDB-349640 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.349640"
},
{
"name": "Submit #765589 | Shy2593666979 AgentChat \u003c= v2.3.0 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.765589"
},
{
"name": "Submit #765590 | Shy2593666979 AgentChat \u003c= v2.3.0 Authorization Bypass (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.765590"
},
{
"tags": [
"related"
],
"url": "https://github.com/CC-T-454455/Vulnerabilities/tree/master/agent-chat/vulnerability-1"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/CC-T-454455/Vulnerabilities/tree/master/agent-chat/vulnerability-2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-07T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-07T09:40:14.000Z",
"value": "VulDB entry last update"
}
],
"title": "Shy2593666979 AgentChat User Endpoint user.py update_user_info resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-3693",
"datePublished": "2026-03-08T00:32:08.162Z",
"dateReserved": "2026-03-07T08:35:06.733Z",
"dateUpdated": "2026-03-11T16:27:34.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0253
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:23
VLAI
EPSS
VEX
Title
Dovecot Security Advisory OXDC-2026-0002
Summary
Hi!
We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. This advisory is also published at
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0002.html
---
Classification: TLP:GREEN
Internal reference: DOV-8967
Type: CWE-235 (Improper Handling of Extra Parameters)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 3.1.4, OX Dovecot CE core 2.4.3
First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4
Discovery date: 2026-03-29
Solution date: 2026-05-05
Disclosure date: 2026-05-05
Researcher credits: caprinuxx@yeswehack
CVE: CVE-2026-27851
CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Details:
lib-var-expand: Safe filter leaks to all following pipelines. When safe filter is used with variable expansion, all
following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped.
Risk:
This can enable SQL / LDAP injection attacks when used in authentication. No publicly available exploits are known.
Solution:
Avoid using safe filter until on fixed version.
---
Internal reference: DOV-8948
Type: CWE-400 (Uncontrolled Resource Consumption)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 2.3.0
First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4
Discovery date: 2026-03-24
Solution date: 2026-05-05
Disclosure date: 2026-05-05
Researcher credits: djvirus@yeswehack
CVE: CVE-2026-40016
CVSS: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Details:
Sieve :contains/:matches O(N×M) Substring Match Bypasses sieve_max_cpu_time Limit (130× Overrun). Attacker can upload a
malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130
times of the configured limit.
Risk:
Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. No
publicly available exploits are known.
Solution:
Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access.
---
Internal reference: DOV-9030
Type: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0
First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4
Discovery date: 2026-04-08
Solution date: 2026-05-05
Disclosure date: 2026-05-05
Researcher credits: ylwango613@yeswehack
CVE: CVE-2026-33603
CVSS: 6.8 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Details:
login: Base64 input can contain tabs that bypass IPC protection. Attacker can use a specially crafted base64 exchange
between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position
itself between Dovecot and the client connection.
Risk:
If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. No publicly
available exploits are known.
Solution:
Install fixed version.
---
Internal reference: DOV-9040
Type: CWE-284 (Improper Access Control)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 2.3.0
First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4
Discovery date: 2026-04-08
Solution date: 2026-05-05
Disclosure date: 2026-05-05
Researcher credits: ilhamaf@yeswehack
CVE: CVE-2026-40020
CVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Details:
IMAP folders can be shared-spammed to everyone. Attacker can use the IMAP SETACL command to inject the anyone
permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users.
Risk:
The impact is limited to being able to spam folders to other users, no unexpected access is gained. No publicly
available exploits are known.
Solution:
Install to fixed version.
---
Internal reference: DOV-9138
Type: CWE-400 (Uncontrolled Resource Consumption)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 3.0.5, OX Dovecot Pro core 3.1.4, OX Dovecot CE core 2.4.3
First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4
Discovery date: 2026-04-27
Solution date: 2026-05-05
Disclosure date: 2026-05-05
Researcher credits: D4RKCYPH3R@yeswehack
CVE: CVE-2026-42006
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Details:
imap-login: Excessive memory usage DoS - Try 2. An attacker can cause uncontrolled memory usage with excessive bracing
over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another
way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit.
Risk:
Using excessive bracing, attacker can cause memory usage up to configured memory limit. No publicly available exploits
are known.
Solution:
Install fixed version, or configure vsz_limit for imap process to low value.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
5 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dovecot | Security Advisory |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0253 (this record)
- related CVE-2026-27851
- related CVE-2026-27857
- related CVE-2026-33603
- related CVE-2026-40016
- related CVE-2026-40020
- related CVE-2026-42006
{
"containers": {
"cna": {
"affected": [
{
"product": "Security Advisory",
"vendor": "Dovecot",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aki Tuomi"
}
],
"descriptions": [
{
"lang": "en",
"value": "Hi!\n\nWe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory is also published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0002.html\n\n---\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-8967\nType: CWE-235 (Improper Handling of Extra Parameters)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.4, OX Dovecot CE core 2.4.3\nFirst fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4\nDiscovery date: 2026-03-29\nSolution date: 2026-05-05\nDisclosure date: 2026-05-05\nResearcher credits: caprinuxx@yeswehack\nCVE: CVE-2026-27851\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nlib-var-expand: Safe filter leaks to all following pipelines. When safe filter is used with variable expansion, all \nfollowing pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped.\n\nRisk:\nThis can enable SQL / LDAP injection attacks when used in authentication. No publicly available exploits are known.\n\nSolution:\nAvoid using safe filter until on fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8948\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4\nDiscovery date: 2026-03-24\nSolution date: 2026-05-05\nDisclosure date: 2026-05-05\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-40016\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nSieve :contains/:matches O(N\u00d7M) Substring Match Bypasses sieve_max_cpu_time Limit (130\u00d7 Overrun). Attacker can upload a \nmalicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 \ntimes of the configured limit.\n\nRisk:\nAttacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. No \npublicly available exploits are known.\n\nSolution:\nInstall fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access.\n\n\n\n---\n\n\n\nInternal reference: DOV-9030\nType: CWE-99 (Improper Control of Resource Identifiers (\u0027Resource Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4\nDiscovery date: 2026-04-08\nSolution date: 2026-05-05\nDisclosure date: 2026-05-05\nResearcher credits: ylwango613@yeswehack\nCVE: CVE-2026-33603\nCVSS: 6.8 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nlogin: Base64 input can contain tabs that bypass IPC protection. Attacker can use a specially crafted base64 exchange \nbetween Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position \nitself between Dovecot and the client connection.\n\nRisk:\nIf successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. No publicly \navailable exploits are known.\n\nSolution:\nInstall fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-9040\nType: CWE-284 (Improper Access Control)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4\nDiscovery date: 2026-04-08\nSolution date: 2026-05-05\nDisclosure date: 2026-05-05\nResearcher credits: ilhamaf@yeswehack\nCVE: CVE-2026-40020\nCVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nIMAP folders can be shared-spammed to everyone. Attacker can use the IMAP SETACL command to inject the anyone \npermission to user\u0027s dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users.\n\nRisk:\nThe impact is limited to being able to spam folders to other users, no unexpected access is gained. No publicly \navailable exploits are known.\n\nSolution:\nInstall to fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-9138\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.0.5, OX Dovecot Pro core 3.1.4, OX Dovecot CE core 2.4.3\nFirst fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4\nDiscovery date: 2026-04-27\nSolution date: 2026-05-05\nDisclosure date: 2026-05-05\nResearcher credits: D4RKCYPH3R@yeswehack\nCVE: CVE-2026-42006\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nimap-login: Excessive memory usage DoS - Try 2. An attacker can cause uncontrolled memory usage with excessive bracing \nover IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another \nway left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit.\n\nRisk:\nUsing excessive bracing, attacker can cause memory usage up to configured memory limit. No publicly available exploits \nare known.\n\nSolution:\nInstall fixed version, or configure vsz_limit for imap process to low value.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-235",
"description": "CWE-235",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-99",
"description": "CWE-99",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:23:37Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/2"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/2"
},
{
"url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0002.html"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/2"
],
"discovery": "EXTERNAL"
},
"title": "Dovecot Security Advisory OXDC-2026-0002",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-27851",
"type": "related"
},
{
"destId": "CVE-2026-27857",
"type": "related"
},
{
"destId": "CVE-2026-33603",
"type": "related"
},
{
"destId": "CVE-2026-40016",
"type": "related"
},
{
"destId": "CVE-2026-40020",
"type": "related"
},
{
"destId": "CVE-2026-42006",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0253",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/2",
"automated": true,
"contentSha256": "953cf42d8d2a923193fdd281db5329f9228543715cf0e022915cdd481a58619d",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/2",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-12T13:41:30Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0253"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:42Z",
"dateUpdated": "2026-09-11T11:23:37Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0253"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-43491 (GCVE-0-2025-43491)
Vulnerability from cvelistv5 – Published: 2025-09-09 20:29 – Updated: 2026-02-26 17:48
VLAI
EPSS
VEX
Title
Poly Lens Desktop Application – Privilege Escalation
Summary
A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-11 03:56 UTC
CWE
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-43491",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-11T03:56:34.376789Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:48:49.381Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Poly Lens",
"vendor": "HP, Inc.",
"versions": [
{
"status": "affected",
"version": "See HP security bulletin reference for affected versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.\u003c/span\u003e"
}
],
"value": "A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "CWE-99",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T20:29:47.968Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_12979589-12979615-16/hpsbpy04048"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Poly Lens Desktop Application \u2013 Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2025-43491",
"datePublished": "2025-09-09T20:29:47.968Z",
"dateReserved": "2025-04-16T15:25:24.713Z",
"dateUpdated": "2026-02-26T17:48:49.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12919 (GCVE-0-2025-12919)
Vulnerability from cvelistv5 – Published: 2025-11-09 20:02 – Updated: 2026-02-24 06:25
VLAI
EPSS
VEX
Title
EverShop Order Order.resolvers.js resource injection
Summary
A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of the component Order Handler. The manipulation of the argument uuid results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-14 17:49 UTC
CWE
- CWE-99 - Improper Control of Resource Identifiers
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.331639 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.331639 | signaturepermissions-required |
| https://vuldb.com/?submit.680788 | third-party-advisory |
| https://github.com/ictrun/Evershop-Order-leak/blo… | related |
| https://github.com/ictrun/Evershop-Order-leak/blo… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12919",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-14T17:49:27.755109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-14T17:49:31.439Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md#attack-steps"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:evershop:evershop:*:*:*:*:*:*:*:*"
],
"modules": [
"Order Handler"
],
"product": "EverShop",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ictrun (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of the component Order Handler. The manipulation of the argument uuid results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T06:25:20.029Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-331639 | EverShop Order Order.resolvers.js resource injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.331639"
},
{
"name": "VDB-331639 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.331639"
},
{
"name": "Submit #680788 | Evershop \u003c= v2.0.1 Insecure Direct Object Reference",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.680788"
},
{
"tags": [
"related"
],
"url": "https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md#attack-steps"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-11-10T14:55:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "EverShop Order Order.resolvers.js resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-12919",
"datePublished": "2025-11-09T20:02:06.116Z",
"dateReserved": "2025-11-09T06:29:03.722Z",
"dateUpdated": "2026-02-24T06:25:20.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12918 (GCVE-0-2025-12918)
Vulnerability from cvelistv5 – Published: 2025-11-09 08:02 – Updated: 2025-11-14 17:45
VLAI
EPSS
VEX
Title
yungifez Skuul School Management System View Fee Invoice fee-invoices resource injection
Summary
A security flaw has been discovered in yungifez Skuul School Management System up to 2.6.5. The impacted element is an unknown function of the file /dashboard/fees/fee-invoices/ of the component View Fee Invoice. Performing manipulation of the argument invoice_id results in improper control of resource identifiers. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-14 17:45 UTC
CWE
- CWE-99 - Improper Control of Resource Identifiers
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.331636 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.331636 | signaturepermissions-required |
| https://vuldb.com/?submit.680686 | third-party-advisory |
| https://gist.github.com/thezeekhan/fbfa9a7dbc0b0b… | related |
| https://gist.github.com/thezeekhan/fbfa9a7dbc0b0b… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| yungifez | Skuul School Management System |
Affected:
2.6.0
Affected: 2.6.1 Affected: 2.6.2 Affected: 2.6.3 Affected: 2.6.4 Affected: 2.6.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12918",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-14T17:45:14.488659Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-14T17:45:18.489Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/thezeekhan/fbfa9a7dbc0b0b81fd868ee166839041#steps-to-reproduce"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/thezeekhan/fbfa9a7dbc0b0b81fd868ee166839041"
},
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/?submit.680686"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"View Fee Invoice"
],
"product": "Skuul School Management System",
"vendor": "yungifez",
"versions": [
{
"status": "affected",
"version": "2.6.0"
},
{
"status": "affected",
"version": "2.6.1"
},
{
"status": "affected",
"version": "2.6.2"
},
{
"status": "affected",
"version": "2.6.3"
},
{
"status": "affected",
"version": "2.6.4"
},
{
"status": "affected",
"version": "2.6.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeeshan Khan (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in yungifez Skuul School Management System up to 2.6.5. The impacted element is an unknown function of the file /dashboard/fees/fee-invoices/ of the component View Fee Invoice. Performing manipulation of the argument invoice_id results in improper control of resource identifiers. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in yungifez Skuul School Management System up to 2.6.5 gefunden. Hierbei betrifft es unbekannten Programmcode der Datei /dashboard/fees/fee-invoices/ der Komponente View Fee Invoice. Durch Manipulation des Arguments invoice_id mit unbekannten Daten kann eine improper control of resource identifiers-Schwachstelle ausgenutzt werden. Der Angriff l\u00e4sst sich \u00fcber das Netzwerk starten. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Es wird angegeben, dass die Ausnutzbarkeit schwierig ist. Der Exploit wurde der \u00d6ffentlichkeit bekannt gemacht und k\u00f6nnte verwendet werden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.1,
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-09T08:02:05.919Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-331636 | yungifez Skuul School Management System View Fee Invoice fee-invoices resource injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.331636"
},
{
"name": "VDB-331636 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.331636"
},
{
"name": "Submit #680686 | yungifez Skuul v2.6.5 Improper Access Controls",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.680686"
},
{
"tags": [
"related"
],
"url": "https://gist.github.com/thezeekhan/fbfa9a7dbc0b0b81fd868ee166839041"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/thezeekhan/fbfa9a7dbc0b0b81fd868ee166839041#steps-to-reproduce"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-11-08T17:51:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "yungifez Skuul School Management System View Fee Invoice fee-invoices resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-12918",
"datePublished": "2025-11-09T08:02:05.919Z",
"dateReserved": "2025-11-08T16:46:55.435Z",
"dateUpdated": "2025-11-14T17:45:18.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12270 (GCVE-0-2025-12270)
Vulnerability from cvelistv5 – Published: 2025-10-27 12:02 – Updated: 2025-10-27 13:16
VLAI
EPSS
VEX
Title
LearnHouse Student Assignment Submission sub_file resource injection
Summary
A vulnerability was determined in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The impacted element is an unknown function of the file /api/v1/assignments/{assignment_id}/tasks/{task_id}/sub_file of the component Student Assignment Submission Handler. This manipulation causes improper control of resource identifiers. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-27 13:16 UTC
CWE
- CWE-99 - Improper Control of Resource Identifiers
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.329942 | vdb-entry |
| https://vuldb.com/?ctiid.329942 | signaturepermissions-required |
| https://vuldb.com/?submit.674147 | third-party-advisory |
| https://gist.github.com/KhanMarshaI/f71f86fbd5d8e… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | LearnHouse |
Affected:
98dfad76aad70711a8113f6c1fdabfccf10509ca
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12270",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-27T13:16:10.753414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-27T13:16:14.087Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/KhanMarshaI/f71f86fbd5d8e8363f9113a8c054c28b"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Student Assignment Submission Handler"
],
"product": "LearnHouse",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "98dfad76aad70711a8113f6c1fdabfccf10509ca"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "KhanMarshal (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The impacted element is an unknown function of the file /api/v1/assignments/{assignment_id}/tasks/{task_id}/sub_file of the component Student Assignment Submission Handler. This manipulation causes improper control of resource identifiers. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca wurde eine Schwachstelle gefunden. Dies betrifft einen unbekannten Teil der Datei /api/v1/assignments/{assignment_id}/tasks/{task_id}/sub_file der Komponente Student Assignment Submission Handler. Durch Manipulation mit unbekannten Daten kann eine improper control of resource identifiers-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Die Schwachstelle wurde \u00f6ffentlich offengelegt und k\u00f6nnte ausgenutzt werden. Dieses Produkt verwendet ein Rolling-Release-Modell, um eine kontinuierliche Auslieferung zu gew\u00e4hrleisten. Daher sind keine Versionsdetails f\u00fcr betroffene oder aktualisierte Releases verf\u00fcgbar."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-27T12:02:07.011Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-329942 | LearnHouse Student Assignment Submission sub_file resource injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.329942"
},
{
"name": "VDB-329942 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.329942"
},
{
"name": "Submit #674147 | LearnHouse learnhouse 98dfad76aad70711a8113f6c1fdabfccf10509ca Insecure Direct Object Reference (IDOR)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.674147"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/KhanMarshaI/f71f86fbd5d8e8363f9113a8c054c28b"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-10-26T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-10-26T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-10-26T17:06:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "LearnHouse Student Assignment Submission sub_file resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-12270",
"datePublished": "2025-10-27T12:02:07.011Z",
"dateReserved": "2025-10-26T16:01:00.403Z",
"dateUpdated": "2025-10-27T13:16:14.087Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, it can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
CAPEC-10: Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the adversary finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
CAPEC-240: Resource Injection
An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended modification or specification of a resource.
CAPEC-75: Manipulating Writeable Configuration Files
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.