https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 20:28:25 +0000 https://db.gcve.eu/vuln/cve-2026-110098 <p><strong>Affected:</strong> Jorani</p> <p>Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees&#39; requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues&#39; leave and overtime requests and read leave history.</p> <p><strong>Affected:</strong> Jorani</p> <p>Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees&#39; requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues&#39; leave and overtime requests and read leave history.</p> https://db.gcve.eu/vuln/cve-2026-110098