Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-119654

DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Devlive-community
Products
Datacap
CVE-2026-111614

DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Devlive-community
Products
Datacap