https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 19:02:35 +0000 https://db.gcve.eu/vuln/fkie_cve-2018-25391 <p>HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record&#39;s id. The admin/modul/mod_pengurus/aksi_pengurus.php (module=pengurus&amp;act=hapus) and admin/modul/mod_update/aksi_update.php (module=update&amp;act=hapus) endpoints process deletions without verifying the requester&#39;s privileges, enabling removal of pengurus (administrator) and update records.</p> <p>HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record&#39;s id. The admin/modul/mod_pengurus/aksi_pengurus.php (module=pengurus&amp;act=hapus) and admin/modul/mod_update/aksi_update.php (module=update&amp;act=hapus) endpoints process deletions without verifying the requester&#39;s privileges, enabling removal of pengurus (administrator) and update records.</p> https://db.gcve.eu/vuln/fkie_cve-2018-25391 https://db.gcve.eu/vuln/ghsa-jv33-m8x5-6599 <p>HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record&#39;s id. The admin/modul/mod_pengurus/aksi_pengurus.php (module=pengurus&amp;act=hapus) and admin/modul/mod_update/aksi_update.php (module=update&amp;act=hapus) endpoints process deletions without verifying the requester&#39;s privileges, enabling removal of pengurus (administrator) and update records.</p> <p>HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record&#39;s id. The admin/modul/mod_pengurus/aksi_pengurus.php (module=pengurus&amp;act=hapus) and admin/modul/mod_update/aksi_update.php (module=update&amp;act=hapus) endpoints process deletions without verifying the requester&#39;s privileges, enabling removal of pengurus (administrator) and update records.</p> https://db.gcve.eu/vuln/ghsa-jv33-m8x5-6599