Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-54105

U.S. GAO EPDS and CBCA EDS user information disclosure

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary 'user_id' parameter and receive a JSON response containing account-specific information, including the associated email address.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Civilian Board Of Contract Appeals Government Accountability Office
Products
Electronic Docketing System (eds) Electronic Protest Docketing System (epds)
CVE-2026-54106

U.S. GAO EPDS and CBCA EDS network access control bypass

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Civilian Board Of Contract Appeals Government Accountability Office
Products
Electronic Docketing System (eds) Electronic Protest Docketing System (epds)
CVE-2026-54103

U.S. GAO EPDS and CBCA EDS unauthenticated password change

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Civilian Board Of Contract Appeals Government Accountability Office
Products
Electronic Docketing System (eds) Electronic Protest Docketing System (epds)
CVE-2026-54104

U.S. GAO EPDS and CBCA EDS client-based privilege escalation

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_id' parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Civilian Board Of Contract Appeals Government Accountability Office
Products
Electronic Docketing System (eds) Electronic Protest Docketing System (epds)