185650 matches found
CVE-2026-105637
Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...
CVE-2026-103086
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...
CVE-2026-103085
Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...
CVE-2026-102383
Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14...
EUVD-2026-92747
Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2...
CVE-2026-103337
The Kirillbdev WC Ukraine Shipping plugin for WordPress is vulnerable to a Broken Access Control flaw (CWE-862) in versions up to and including 1.23.2 . The vulnerability stems from Missing Authorization , which allows for the exploitation of incorrectly configured access control security levels....
CVE-2026-103337 WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2...
CVE-2023-49981
CVE-2023-49981 School Fees Management System v1.0 - 访问控制不当 - 目录浏览 描述 ：School Fees Management System v1.0 中的目录浏览漏洞允许攻击者在无需身份验证/授权的情况下列出应用程序中的目录和敏感文件。 受影响产品版本 ：School Fees Management System v1.0 CVE 作者 ：Geraldo Alcântara 日期 ：28/11/2023 确认于 ：19/12/2023 CVE ：CVE-2023-49981 测试平台 ：Windows 复现步骤： 受影响组件：...
CVE-2026-52199
CVE-2026-52199：UZ801 4G 路由器中的未认证远程代码执行漏洞 漏洞摘要 Generic OEM UZ801v2.1 4G LTE 路由器（固件 V3.4.3） 中存在一个严重的不正确的访问控制 漏洞。该设备错误地将一个未认证的安卓调试桥（ADB）守护进程（/sbin/adbd）暴露在 TCP 端口 7628 上，供相邻网络（局域网/无线网络）访问。 连接到设备本地网络的攻击者可以利用此缺陷绕过所有认证机制，建立 ADB 连接，并以 root 权限执行任意代码。 受影响产品 厂商： Generic OEM / 白标生态 产品： UZ801v2.1 4G LTE 路由器...
CVE-2025-25615
CVE-2025-25615 Unifiedtransform v2.0 存在不正确的访问控制漏洞，允许教师查看所有班级的考勤列表。 厂商：Unifiedtransform PoC 步骤1： 以教师身份登录应用程序。 步骤2： 访问以下端点： /attendances/view?classid=1§ionid=2&courseid=1 （修改 classid 和 sectionid 参数以访问不同的班级。） 步骤3： 查看任意班级的考勤情况。 影响： 这允许未经授权访问所有班级的考勤数据，而该功能本应仅限于管理员使用。这可能导致隐私泄露和数据滥用。 漏洞类型： 不正确的访问控制...
throttlestop-exploit-rw
Physical Memory Mapper 研究工具，通过虚拟地址到物理地址的转换结合脆弱驱动程序利用，演示物理内存访问。 概述 本项目探索了底层 Windows 内存管理，结合 superfetch 技术进行地址转换和基于 IOCTL 的物理内存访问。旨在理解内核模式/用户模式交互以及内存子系统内部机制。 CVE-2025-7771 – ThrottleStop.sys 物理内存读写 漏洞摘要 CVE ID： CVE-2025-7771 组件： ThrottleStop.sys（来自 TechPowerUp LLC 的已签名驱动） 受影响版本： ThrottleStop 3.0.0....
CVE-2026-97303
The Scratch & Win – Giveaways and Contests WordPress plugin (versions
CVE-2026-97303 WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2...
EUVD-2026-92592
Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2...
CVE-2026-97305 WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...
CVE-2026-97070
The Cozy Blocks WordPress plugin (versions
EUVD-2026-92586
Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...
EUVD-2026-92587
Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23...