190309 matches found
CVE-2026-85209
The Learning Management System (LMS) developed by AVEZ Electronics Communication Training and Consultancy Trade Inc. is impacted by a Missing Authorization vulnerability (CWE-862). The root cause is incorrectly configured access control security levels , which allows for exploitation. The vulnera...
EUVD-2026-91567
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System LMS: through 2026-09-18...
CVE-2026-85209 IDOR in AVEZ Electronics's LMS
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System LMS: through 2026-09-18...
CVE-2026-104455 YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every...
EUVD-2026-91466
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every...
CVE-2026-104455
YesWiki versions prior to 4.6.7 are vulnerable to an access control bypass via the recentchangesrssplus RSS action. Unauthenticated attackers can request the xml method of a page hosting this action to retrieve 500-character body excerpts of all latest pages. This includes access to read-restrict...
CVE-2026-104455 YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every...
CVE-2026-104455 YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every...
CVE-2026-104449 YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled idfiche...
EUVD-2026-91460
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled idfiche...
CVE-2026-104449
Versions of YesWiki prior to 4.6.7 are susceptible to an access control vulnerability (CWE-639) within the Bazar entry-creation flow . This flaw allows unauthenticated attackers to overwrite any existing wiki page—even those protected by write ACLs—by submitting a crafted entry where the attacker...
CVE-2026-104449 YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled idfiche...
axios: Axios: HTTP header injection via inherited prototype properties
A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...
axios: Axios: HTTP header injection via inherited prototype properties
A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...
axios: Axios: HTTP header injection via inherited prototype properties
A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...
CVE-2026-104403
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9...
CVE-2026-104403 WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9...
CVE-2026-104403 WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9...
EUVD-2026-91380
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9...
CVE-2026-104403
The ThimPress LearnPress WordPress plugin (versions up to and including 4.4.9 ) is susceptible to an Authorization Bypass Through User-Controlled Key vulnerability. This flaw arises from incorrectly configured access control security levels , which can lead to Insecure Direct Object References (I...