Enocta Platform
Monthly
Authorization bypass in Enocta Platform (all versions through 2026-09-28) lets an authenticated low-privilege user read or alter other users' records by tampering with a user-controlled identifier in requests. With a CVSS 3.1 base score of 8.1 (High), the flaw yields high confidentiality and integrity impact but no availability impact. No public exploit code has been identified and the issue is not in CISA KEV; exploitation requires a valid low-privilege account on the platform.
Cross-site scripting (XSS) in Enocta Platform allows authenticated users to inject script into HTML attribute contexts, potentially modifying the appearance or behavior of pages viewed by other users. The flaw affects all versions through 2026-09-28 according to TR-CERT, and exploitation requires an authenticated account (PR:L) plus a victim who views the crafted content (UI:R), yielding only limited integrity impact (CVSS 4.1). No public exploit identified at time of analysis.
Authorization bypass in Enocta Platform (all versions through 2026-09-28) lets an authenticated low-privilege user read or alter other users' records by tampering with a user-controlled identifier in requests. With a CVSS 3.1 base score of 8.1 (High), the flaw yields high confidentiality and integrity impact but no availability impact. No public exploit code has been identified and the issue is not in CISA KEV; exploitation requires a valid low-privilege account on the platform.
Cross-site scripting (XSS) in Enocta Platform allows authenticated users to inject script into HTML attribute contexts, potentially modifying the appearance or behavior of pages viewed by other users. The flaw affects all versions through 2026-09-28 according to TR-CERT, and exploitation requires an authenticated account (PR:L) plus a victim who views the crafted content (UI:R), yielding only limited integrity impact (CVSS 4.1). No public exploit identified at time of analysis.