CVE-2026-105129

LaraDashboard versions prior to 1.4.8 are vulnerable to an incorrect authorization flaw (CWE-863) in the settings API. Authenticated users possessing only the settings.view permission can perform GET requests to /api/settings or /api/settings/{option_name} to access sensitive data. This vulnerabi...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability

Settings Change vulnerability discovered by Mor Golan in WordPress Plugin 워드프레스 결제 심플페이 versions = 5.5.17...

CVE-2023-6289

CVE-2023-6289 Swift Performance Lite = 2.3.6.14 - 인증되지 않은 설정 내보내기를 허용하는 권한 누락 설명 Swift Performance Lite 플러그인은 WordPress에서 모든 버전최대 2.3.6.14 포함에서 admininit 함수를 통해 연결된 기능에 대한 기능 검사capability check가 누락되어 데이터에 대한 무단 접근에 취약합니다. 이로 인해 인증되지 않은 공격자가 Cloudflare API 토큰을 포함할 수 있는 플러그인 설정을 내보낼 수 있습니다. Severit...

CSZ-CMS-Stored-XSS---Site-Settings

CSZ CMS Stored XSS v1.3.0 작성자: Sergio 설명: CSZCMS v.1.3.0의 크로스 사이트 스크립팅XSS 취약점으로 인해 로컬 공격자가 Site Settings 메뉴의 Additional Meta Tag 매개변수에 조작된 스크립트를 삽입하여 임의 코드를 실행할 수 있습니다. 공격 벡터: 스크립팅Scripting: 'Site Settings'의 Additional Meta Tag 입력값에 대한 살균 과정의 취약점으로 인해 사용자가 웹 페이지 및 하위 페이지에 접근할 때 실행되는 JavaScript 코드...

CVE-2025-60854

CVE-2025-60854 D-link AX1500 の脆弱性 最近、D-Link ルーターの脆弱性分析を実施しましたので、その調査結果を文書化したいと思います。 対象モデル: D-Link AX1500 バージョン : 1.20.01 以下 この問題の CVE 番号は現在公開されています。 脆弱な関数は以下のとおりです: int fastcall sub46AE00int a1 unsigned int32 v2; // $v1 int v3; // $s1 int v4; // $t8 int v6; // $v0 int v7; // $s3 int v8; // $s3 ch...

CVE-2026-13156

CVE-2026-13156 — MailerSend公式SMTP統合プラグイン !IMPORTANT 概要: WordPress用公式 MailerSend SMTP統合プラグイン （ 1.0.8）において、高深刻度のクロスサイト・リクエスト・フォージェリ（CSRF ）脆弱性（CVE-2026-13156）が発見されました。設定削除ハンドラ mailersendhandleconfigurationdelete...

CVE-2026-101162

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled...

CVE-2026-101161

The WP Ultimate Review WordPress plugin, in versions before 2.4.4 , is vulnerable to a persistent denial of service (DoS) . Unauthenticated users can store crafted review content that triggers a fatal error on every subsequent visit to the reviewed page. This impact occurs specifically when the p...

CVE-2026-101162 WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled...

CVE-2026-101161 WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin...

EUVD-2026-91931

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin...

CVE-2026-101162 WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled...

CVE-2026-101162

The WP Ultimate Review WordPress plugin, in versions prior to 2.4.4 , is vulnerable to Stored Cross-Site Scripting (XSS) . The issue stems from the application failing to properly escape certain review overview settings before they are displayed in posts. If author reviews are enabled, an attacke...

CVE-2026-101161 WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin...

CVE-2025-65672

CVE-2025-65672 classroomio 0.1.13의 취약한 직접 객체 참조IDOR로 인해 과정 설정에 대한 승인되지 않은 공유 및 초대 액세스가 허용됩니다. 영향받는 제품: ClassroomIO 영향받는 버전: 0.1.13 발견자: Rivek Raj Tamang RivuDon, Sikkim, 인도 취약점 세부 정보 취약한 직접 객체 참조IDOR / 손상된 접근 제어 요약 ClassroomIO 버전 0.1.13에는 학생비권한 사용자이 제한된 과정 설정, 특히 공유 및 초대 관리 인터페이스에 액세스할 수 있도록 하는...

[SECURITY] Fedora 45 Update: libwebcam-0.2.5-26.fc45

Libwebcam provides a user-space library for interaction with the uvcvideo kernel driver. One could use this library to manipulate settings for one or many UVC-type webcams found attached on a single computer...

EUVD-2026-91851

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

CVE-2026-104475

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

CVE-2026-104475: Improper Neutralization of Input During Web Page Generation

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...