4399 matches found
WordPress Restrict User Access <= 2.5 - Cross-Site Scripting
WordPress Restrict User Access – Membership Plugin with Force versions before 2.6 is vulnerable to Reflected Cross-Site Scripting via the 'ruasection' parameter in the admin level edit page. id: CVE-2024-29138 info: name: WordPress Restrict User Access = 2.5 - Cross-Site Scripting author: Shivam...
CVE-2023-47668
CVE-2023-47668 Restrict Content = 3.2.7 - Information Exposure via legacy log file Description: The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.7 via the legacy log file. This makes it possible...
CVE-2026-78153
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...
CVE-2026-78153 Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...
CVE-2026-78153
The Restrict User Access WordPress plugin versions before 2.8.1 fail to normalise the REST API route before comparing it against protected routes. This route normalization flaw allows unauthenticated attackers to bypass content protection, read restricted content, and enumerate users via the REST...
EUVD-2026-70042
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...
CVE-2023-47668
CVE-2023-47668 描述 StellarWP Membership Plugin – Restrict Content 插件 结果示例 root@kitploit: Log file content: 2024-12-24 20:47:19 - wprcpdiscounts table upgrade to 202003311 successful. 2024-12-24 20:47:19 - wprcpdiscounts table upgrade to 202003312 successful. 2024-12-24 20:47:19 - wprcpdiscounts...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation of the Pointer Lock feature in Google Chrome on Mac before version 105.0.5195.52 allowed a remote attacker to restrict user navigation through a crafted HTML page...
Astra Linux – Vulnerability in Redis
Redis is an open-source, in-memory database that persists data on disk. In versions prior to 8.0.3, as well as in 7.4.5, 7.2.10, and 6.2.19, an authenticated user could use a specially crafted string to trigger an out-of-bounds write operation on the hyperloglog data structure, potentially leadin...
CVE-2026-65974 ERPNext: Server-Side Template Injection leading to Remote Code Execution
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...
CVE-2026-73283
A flaw was found in OpenSSH's sshd component. The restrict keyword, designed to limit tunnel forwarding within the authorizedkeys file, was not correctly enforced for tunnel forwarding. This issue could allow a local attacker to bypass intended security restrictions, potentially leading to...
SUSE CVE-2026-18408
Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-871...
SUSE CVE-2026-73283
In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not...
CVE-2026-18408
Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-871...
ALPINE-CVE-2026-18408
Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-871...
UBUNTU-CVE-2026-18408
Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-871...
Linux Distros Unpatched Vulnerability : CVE-2026-73283
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not. CVE-2026-73283 Note that...
AZL-95532 CVE-2026-73283 affecting package openssh 9.8p1-9
In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not...
