CVE-2026-14953
A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.20%
- CWE
- CWE-425
- Published
- 2026-08-20
- Last modified
- 2026-08-20
Affected products
- Frauscher Sensortechnik FDS 102
Weakness type
Related vulnerabilities
- CVE-2026-78051 — alexta69 MeTube Cookie File cookies.txt file access
- CVE-2026-76799 — code-projects Login Registration System SQL Database Backup login_registration_system.sql file access
- CVE-2026-19903 — SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access
- CVE-2026-60011 — Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly...
- CVE-2026-21760 — Unauthorized Access to Admin Functionality via Forced Browsing
- CVE-2024-23573 — HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that...
- CVE-2026-13533 — agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access
- CVE-2026-10521 — Authenticated unintended access to critical program parameters