CWE-639

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100514",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T15:59:27.744920Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T15:59:33.462Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "wp-rest-api-log",
          "product": "REST API Log",
          "vendor": "Pete Nelson",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.7.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.7.2",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Nixxies | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Insecure Direct Object References (IDOR) in REST API Log \u003c= 1.7.2 versions."
            }
          ],
          "value": "Unauthenticated Insecure Direct Object References (IDOR) in REST API Log \u003c= 1.7.2 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T14:34:04.730Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/wp-rest-api-log/vulnerability/wordpress-rest-api-log-plugin-1-7-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress REST API Log plugin to the latest available version (at least 1.7.3)."
            }
          ],
          "value": "Update the WordPress REST API Log plugin to the latest available version (at least 1.7.3)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress REST API Log plugin \u003c= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-100514",
    "datePublished": "2026-10-01T14:34:04.730Z",
    "dateReserved": "2026-09-26T00:17:50.215Z",
    "dateUpdated": "2026-10-01T15:59:33.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100364",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T17:59:56.990446Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T18:00:44.222Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SuiteCRM",
          "vendor": "SuiteCRM",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.15.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.10.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord() and uses processAttributes(), id, and ACL_ALLOW_OWNER to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can substitute a victim record identifier, bypass owner-only authorization, overwrite another record, and hijack record ownership. This issue is fixed in versions 7.15.2 and 8.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T18:39:41.969Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-8rjm-vpj3-hch8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-8rjm-vpj3-hch8"
        },
        {
          "name": "https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68"
        },
        {
          "name": "https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c"
        },
        {
          "name": "https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2"
        },
        {
          "name": "https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2"
        }
      ],
      "source": {
        "advisory": "GHSA-8rjm-vpj3-hch8",
        "discovery": "UNKNOWN"
      },
      "title": "SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-100364",
    "datePublished": "2026-11-05T18:39:41.969Z",
    "dateReserved": "2026-09-25T19:19:54.698Z",
    "dateUpdated": "2026-11-09T18:00:44.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100177",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T14:55:38.429027Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T14:55:51.640Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "bin/lib/crawlers.py",
            "var/www/blueprints/api_rest.py",
            "var/www/blueprints/crawler_splash.py"
          ],
          "product": "ail framework",
          "programFiles": [
            "bin/lib/crawlers.py",
            "var/www/blueprints/api_rest.py",
            "var/www/blueprints/crawler_splash.py"
          ],
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail project",
          "versions": [
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "terrtia"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar\u0027s owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user\u0027s role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization\u0027s cookiejar by UUID and have the crawler use that organization\u0027s stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization\u0027s session data.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThe vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization\u0027s stored cookies and session data through the crawler infrastructure.\u003c/p\u003e"
            }
          ],
          "value": "The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar\u0027s owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user\u0027s role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization\u0027s cookiejar by UUID and have the crawler use that organization\u0027s stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization\u0027s session data.\n\n\nThe vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization\u0027s stored cookies and session data through the crawler infrastructure."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Tamper with URLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T13:35:50.465Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/3773ca36658c57ce592aebe74e27c855eb64f58a"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe cookiejar attachment path in api_add_crawler_task is now validated through the existing api_check_cookiejar_access_acl() function, which enforces organization, user, and role-based access control for the \u0027view\u0027 action on the referenced cookiejar. The user_role parameter is propagated from the API and UI entry points (api_rest.py, crawler_splash.py) into the ACL check. Separately, URL scheme validation is enforced unconditionally: only http and https schemes are accepted, and non-conforming URLs are rejected with a 400 error before any further processing.\u003c/p\u003e"
            }
          ],
          "value": "The cookiejar attachment path in api_add_crawler_task is now validated through the existing api_check_cookiejar_access_acl() function, which enforces organization, user, and role-based access control for the \u0027view\u0027 action on the referenced cookiejar. The user_role parameter is propagated from the API and UI entry points (api_rest.py, crawler_splash.py) into the ACL check. Separately, URL scheme validation is enforced unconditionally: only http and https schemes are accepted, and non-conforming URLs are rejected with a 400 error before any further processing."
        }
      ],
      "title": "Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "none",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The api_check_cookiejar_access_acl() function is assumed to correctly enforce organization, user, and role-based access control; its implementation is not included in this patch.",
                  "The cookiejar UUID is assumed to be guessable or discoverable by an authenticated user (e.g., via enumeration or information leakage); if UUIDs are truly random and unguessable, exploitability is reduced but the authorization flaw remains.",
                  "The CVSS assumes the primary security impact is subsequent confidentiality (access to another org\u0027s cookies/sessions) rather than direct compromise of the Ail Framework itself.",
                  "The CAPEC-1 mapping is the closest available pattern for an IDOR/parameter-substitution attack; no CAPEC specifically covers insecure direct object reference, so this mapping carries some uncertainty.",
                  "The affected version boundary is inferred from the tag v7.1 (26 commits after the fix commit), suggesting the fix landed before the v7.1 release; exact affected version range is not confirmed.",
                  "The URL scheme validation fix (rejecting data:/file: schemes) is treated as a secondary hardening change within the same patch set rather than a separate vulnerability."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The attacker tampers with the cookiejar UUID parameter in the crawler task creation API request to reference a resource (cookiejar) belonging to another organization. The system failed to validate that the referenced object was accessible to the requesting user\u0027s organization. This is the closest CAPEC pattern to an IDOR-style parameter substitution; no CAPEC specifically named \u0027Insecure Direct Object Reference\u0027 exists, so CAPEC-1 (modifying a request parameter to access unauthorized resources) is the best available match."
                  }
                ],
                "commit": "3773ca36658c57ce592aebe74e27c855eb64f58a",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "terrtia"
                  }
                ],
                "cvssRationale": "The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) since the attacker only needs to substitute a known or guessed cookiejar UUID in an API request. No attack target manipulation is required (AT:N). An authenticated user with crawler task creation privileges is needed (PR:L). No user interaction is required (UI:N). The vulnerable component itself does not lose confidentiality, integrity, or availability (VC:N, VI:N, VA:N). However, the subsequent impact is high on confidentiality (SC:H) because the attacker gains access to another organization\u0027s stored cookies and session tokens via the crawler, which could be used to impersonate the victim on target sites. No subsequent integrity or availability impact is evident (SI:N, SA:N).",
                "fixSummary": "The cookiejar attachment path in api_add_crawler_task is now validated through the existing api_check_cookiejar_access_acl() function, which enforces organization, user, and role-based access control for the \u0027view\u0027 action on the referenced cookiejar. The user_role parameter is propagated from the API and UI entry points (api_rest.py, crawler_splash.py) into the ACL check. Separately, URL scheme validation is enforced unconditionally: only http and https schemes are accepted, and non-conforming URLs are rejected with a 400 error before any further processing.",
                "generatedAt": "2026-09-25T13:30:48.386437Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "43e163a1b90d5926293d5dbd7982d46241f08d7a9d2cb0edf86c963f794afac5",
                "patchSummary": "In bin/lib/crawlers.py: (1) is_global_url() now returns False for any scheme other than http/https (previously returned True for data/file schemes) and handles URLs lacking a netloc by prepending http://. (2) api_validate_global_urls() now rejects non-HTTP/HTTPS schemes with a 400 error before the local-IP filter check. (3) The Cookiejar class gains a get_creator() alias. (4) The CrawlerTask.create() method validates the URL scheme. (5) api_add_crawler_task() replaces the inline level-0 user-ID comparison with a call to api_check_cookiejar_access_acl(cookiejar_uuid, user_org, user_id, user_role, action=\u0027view\u0027) and accepts a new user_role parameter. (6) api_add_crawler_capture() now calls api_validate_global_urls(). In var/www/blueprints/api_rest.py and crawler_splash.py: user_role is extracted from the authenticated session and passed to api_add_crawler_task().",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "3773ca36658c57ce592aebe74e27c855eb64f58a",
                    "patchSha256": "43e163a1b90d5926293d5dbd7982d46241f08d7a9d2cb0edf86c963f794afac5",
                    "source": "https://github.com/ail-project/ail-framework/commit/3773ca36658c57ce592aebe74e27c855eb64f58a.patch",
                    "sourceUrl": "https://github.com/ail-project/ail-framework/commit/3773ca36658c57ce592aebe74e27c855eb64f58a.patch",
                    "subject": "chg: [security] crawler, enforce cookiejar ACL when creating"
                  }
                ],
                "source": "https://github.com/ail-project/ail-framework/commit/3773ca36658c57ce592aebe74e27c855eb64f58a.patch",
                "subject": "chg: [security] crawler, enforce cookiejar ACL when creating",
                "tagVersionBoundary": {
                  "commits_after_fix": 26,
                  "repository": "https://github.com/ail-project/ail-framework",
                  "tag": "v7.1",
                  "version": "7.1",
                  "version_type": "custom"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-639",
                    "rationale": "The cookiejar UUID is a user-supplied identifier (key) that was not properly validated against the requesting user\u0027s organization and role. The old code only compared user IDs when level was 0 and skipped the check entirely otherwise, allowing cross-organization access to another user\u0027s cookiejar."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The URL scheme validation was incorrect: data: and file: schemes were treated as valid global URLs, and the scheme check was skipped when the local-IP filter was disabled. The fix enforces that only http and https schemes are accepted unconditionally."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20183"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-100177",
    "datePublished": "2026-09-25T13:35:50.465Z",
    "dateReserved": "2026-09-25T13:35:37.184Z",
    "dateUpdated": "2026-09-25T14:55:51.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97898",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T12:18:28.132095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T12:29:34.364Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "akia",
          "vendor": "akia",
          "versions": [
            {
              "lessThan": "2026.10.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Philipp Br\u00fcgger"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eInsecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest\u0027s booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eAs of 19th September 2026 the service is no more vulnerable to this attack (feedback received by the reporter).\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe attack is remote but the effect is local to an affected property.\u0026nbsp;\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest\u0027s booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property.\n\n\n\n\nAs of 19th September 2026 the service is no more vulnerable to this attack (feedback received by the reporter).\u00a0\n\n\n\n\nThe attack is remote but the effect is local to an affected property."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T10:07:35.224Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://www.akia.com/platform/keyless-entry"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "exclusively-hosted-service"
      ],
      "title": "Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20108"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-97898",
    "datePublished": "2026-09-25T10:07:35.224Z",
    "dateReserved": "2026-09-25T10:07:22.362Z",
    "dateUpdated": "2026-09-25T12:29:34.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97721",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T19:08:34.073456Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T19:08:55.930Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "exportExcel/exportData"
          ],
          "product": "PublicCMS",
          "vendor": "Sanluan",
          "versions": [
            {
              "status": "affected",
              "version": "6.202506.a"
            },
            {
              "status": "affected",
              "version": "6.202506.b"
            },
            {
              "status": "affected",
              "version": "6.202506.c"
            },
            {
              "status": "affected",
              "version": "6.202506.d"
            },
            {
              "status": "affected",
              "version": "6.202506.e"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "aibot88 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java of the component exportExcel/exportData. This manipulation of the argument userId/deptId causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 3.3,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:45:10.045Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-409820 | Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/409820"
        },
        {
          "name": "VDB-409820 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/409820/cti"
        },
        {
          "name": "CVE-2026-97721 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-97721"
        },
        {
          "name": "Submit #910956 | sanluan publiccms 5.0 Authorization Bypass Through User-Controlled SQL Primary Key",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/910956"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/aibot88/CVERequest/blob/main/PublicCMS/issue7.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-25T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-25T03:06:30.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-97721",
    "datePublished": "2026-09-25T05:45:10.045Z",
    "dateReserved": "2026-09-25T00:36:49.843Z",
    "dateUpdated": "2026-09-29T19:08:55.930Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97685",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:12:13.163187Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:13:43.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://fluidattacks.com/es/advisories/zoo"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux"
          ],
          "product": "LimeSurvey",
          "vendor": "LimeSurvey",
          "versions": [
            {
              "status": "affected",
              "version": "7.3.0"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:limesurvey:limesurvey:7.3.0:*:windows:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:limesurvey:limesurvey:7.3.0:*:macos:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:limesurvey:limesurvey:7.3.0:*:linux:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Miguel G\u00f3mez"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user\u0027s survey. The REST survey-patching endpoint checks the attacker\u0027s permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user\u0027s survey. The REST survey-patching endpoint checks the attacker\u0027s permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T02:20:43.077Z",
        "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
        "shortName": "Fluid Attacks"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://fluidattacks.com/es/advisories/zoo"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/LimeSurvey/LimeSurvey/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/LimeSurvey/LimeSurvey/commit/a39a01537a8f79581bd630bcac94f71ae6ce2cce"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
    "assignerShortName": "Fluid Attacks",
    "cveId": "CVE-2026-97685",
    "datePublished": "2026-09-29T02:20:43.077Z",
    "dateReserved": "2026-09-24T21:11:19.206Z",
    "dateUpdated": "2026-09-30T15:13:43.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97657",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:23:42.749655Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:23:49.214Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Abandoned Cart Pro for WooCommerce",
          "vendor": "Tyche Softwares",
          "versions": [
            {
              "lessThanOrEqual": "10.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "andrea bocchetti"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens \u2014 where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter \u2014 combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim\u0027s cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user \u2014 achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T02:27:38.566Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b25b4aed-94b2-4c16-8e4e-39aec4e5e22a?source=cve"
        },
        {
          "url": "https://www.tychesoftwares.com/docs/docs/abandoned-cart-pro-for-woocommerce-new/changelog-abandoned-cart-pro/"
        },
        {
          "url": "https://www.tychesoftwares.com/products/woocommerce-abandoned-cart-pro-plugin/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-13T13:52:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Abandoned Cart Pro for WooCommerce \u003c= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link \u0027validate\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-97657",
    "datePublished": "2026-10-14T02:27:38.566Z",
    "dateReserved": "2026-09-24T19:30:09.456Z",
    "dateUpdated": "2026-10-14T18:23:49.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97647",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T03:22:34.688106Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T03:22:47.205Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ningzichun:student-management-system:*:*:*:*:*:*:*:*"
          ],
          "product": "student-management-system",
          "vendor": "ningzichun",
          "versions": [
            {
              "status": "affected",
              "version": "98760f5711cf6dc8b4adca53a9e207ca49b02ebf"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "jessica.xiao (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T01:15:17.330Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-409749 | ningzichun student-management-system editLog.php authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/409749"
        },
        {
          "name": "VDB-409749 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/409749/cti"
        },
        {
          "name": "CVE-2026-97647 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-97647"
        },
        {
          "name": "Submit #910056 | ningzichun student-management-system 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Authorization Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/910056"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/ningzichun/student-management-system/issues/10"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/ningzichun/student-management-system/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-24T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-24T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-24T20:58:41.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "ningzichun student-management-system editLog.php authorization",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-97647",
    "datePublished": "2026-09-25T01:15:17.330Z",
    "dateReserved": "2026-09-24T18:53:06.786Z",
    "dateUpdated": "2026-09-29T03:22:47.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97646",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T15:42:42.847944Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T15:43:34.951Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ningzichun:student-management-system:*:*:*:*:*:*:*:*"
          ],
          "product": "student-management-system",
          "vendor": "ningzichun",
          "versions": [
            {
              "status": "affected",
              "version": "98760f5711cf6dc8b4adca53a9e207ca49b02ebf"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "jessica.xiao (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the file admin/fun/getStudent.php. This manipulation of the argument sid causes authorization bypass. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T00:15:17.727Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-409748 | ningzichun student-management-system getStudent.php authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/409748"
        },
        {
          "name": "VDB-409748 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/409748/cti"
        },
        {
          "name": "CVE-2026-97646 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-97646"
        },
        {
          "name": "Submit #910054 | ningzichun student-management-system 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Authorization Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/910054"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/ningzichun/student-management-system/issues/9"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/ningzichun/student-management-system/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-24T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-24T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-24T20:58:36.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "ningzichun student-management-system getStudent.php authorization",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-97646",
    "datePublished": "2026-09-25T00:15:17.727Z",
    "dateReserved": "2026-09-24T18:53:02.505Z",
    "dateUpdated": "2026-09-25T15:43:34.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97638",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T17:34:15.270358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:08:58.688Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Forminator Forms \u2013 Contact Form, Payment Form \u0026 Custom Form Builder",
          "vendor": "wpmudev",
          "versions": [
            {
              "lessThanOrEqual": "1.57.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence Argus"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Forminator Forms \u2013 Contact Form, Payment Form \u0026 Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the \u0027previous_draft_id\u0027 parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim\u0027s draft_id, which may be harvested from a shared \"continue later\" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T17:15:27.922Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/61d065d0-d61e-4e65-99ae-eded211681ac?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/model/class-form-entry-model.php#L3110"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/model/class-form-entry-model.php#L429"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/custom-forms/front/front-action.php#L1685"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/custom-forms/front/front-action.php#L3662"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L196"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L127"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3732192%40forminator%2Ftags%2F1.57.3.1\u0026old=3700727%40forminator%2Ftags%2F1.57.3"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3732209/forminator/trunk/library/modules/custom-forms/front/front-action.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-24T17:37:41.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T16:39:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Forminator Forms \u003c= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via \u0027previous_draft_id\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-97638",
    "datePublished": "2026-10-30T17:15:27.922Z",
    "dateReserved": "2026-09-24T17:22:34.939Z",
    "dateUpdated": "2026-10-30T18:08:58.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}