https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T15:47:22.859889+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349638 EUVD-2026-349638 2026-10-09T15:47:22.910806+00:00 EUVD-2026-349638 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71241 fkie_cve-2026-71241 2026-10-09T15:47:22.910845+00:00

Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.

 https://cve.radiocsirt.org/vuln/ghsa-9q89-f4h2-5wx7 GHSA-9q89-f4h2-5wx7 2026-10-09T15:47:22.910881+00:00

Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. This allows any unauthenticated remote user to retrieve student PII (name, gender, card validity, debt status) and full book-borrowing history by supplying a card_id. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.