WordPress Modernize Theme <= 3.4.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Ananda Dhakal Patchstack in WordPress Theme Modernize versions = 3.4.0...

CVE-2025-30993 WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.7 - Broken Access Control Vulnerability

Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: from n/a through = 1.1.7...

CVE-2025-52775 WordPress Project Cost Calculator Plugin <= 1.0.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Ronik@UnlimitedWP Project Cost Calculator project-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Project Cost Calculator: from n/a through = 1.0.0...

WordPress plugin WP Private Content Plus 信息泄露漏洞

WordPress WP Private Content Plus plugin is a WordPress plugin that is mainly used for permission control of website content and supports access restrictions on posts, pages, custom content types, navigation menus, plugins and attachments. WordPress WP Private Content Plus plugin suffers from an...

CVE-2025-21011

Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to motion and body sensors...

CVE-2025-46391

CWE-284: Improper Access Control...

CVE-2025-46391

CWE-284: Improper Access Control...

CVE-2025-21011

Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to motion and body sensors...

PT-2025-32113 · Samsung · Galaxy Wearable

Name of the Vulnerable Software and Affected Versions: Galaxy Wearable versions prior to 2.2.63.25042861 Description: Improper access control in Galaxy Wearable allows local attackers to access sensitive information. Recommendations: Update Galaxy Wearable to version 2.2.63.25042861 or later...

PT-2025-31953 · Unknown · Agenzia Impresa Eccobook

Name of the Vulnerable Software and Affected Versions: Agenzia Impresa Eccobook versions 2.81.1 Description: An incorrect access control issue exists in CaricaVerbale within Agenzia Impresa Eccobook. Authenticated attackers with low-level access can escalate privileges to Administrator...

CVE-2025-50870

The CVE-2025-50870 affects Institute-of-Current-Students version 1.0, where the mydetailsstudent.php endpoint's myds GET parameter accepts an email and returns the corresponding student’s personal information without validating the requester’s identity or permissions. This Incorrect Access Contro...

CVE-2025-50870

Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the...

CVE-2025-28170

Grandstream Networks GXP1628 =1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files...

PT-2025-31526 · Exagrid · Exagrid Ex10

Name of the Vulnerable Software and Affected Versions: ExaGrid EX10 versions 6.3 through 7.0.1.P08 Description: The software is susceptible to incorrect access control. Users with operator-level privileges can retrieve SMTP credentials, including plaintext passwords, by issuing an HTTP request to...

CVE-2025-26062

An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentially sensitive information from the current settings...

CVE-2025-28170

Grandstream Networks GXP1628 =1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files...

Missing Authentication

backend.ai is vulnerable to Missing Authentication. The vulnerability is due to improper access control caused by lack of authentication checks in the registration feature, allowing arbitrary users to create accounts and access private data even when registration is disabled...

MikroTik RouterOS <= 7.19.3 Access Control Vulnerability

MikroTik RouterOS is prone to an access control vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:mikrotik:routeros"...

WordPress Realty Portal – Agent plugin <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function vulnerability

Missing Authorization to Authenticated Subscriber+ Privilege Escalation via rpuserprofile Function vulnerability discovered by theviper17y in WordPress Plugin Realty Portal – Agent versions = 0.3.9...

CVE-2025-6741

CVE-2025-6741 describes improper access control in the Devolutions Server secure message component, enabling an authenticated user to steal unauthorized entries via the secure message entry attachment feature. Affected are Devolutions Server 2025.2.2.0–2025.2.4.0 and 2025.1.11.0 and earlier. Root...