Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 16:31:17 +0000 CVE-2026-71241 — Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History https://vulnerability.circl.lu/vuln/cve-2026-71241 <p><strong>Affected:</strong> lyric777 Book-Management-System</p> <p>Book-Management-System&#39;s Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.</p> <p><strong>Affected:</strong> lyric777 Book-Management-System</p> <p>Book-Management-System&#39;s Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.</p> https://vulnerability.circl.lu/vuln/cve-2026-71241