Lucene search
+L

168932 matches found

CVE
CVE
added 2026/09/04 10:15 a.m.10 views

CVE-2026-85512

SourceCodester Class and Exam Timetabling System 1.0 is affected by a missing authorization vulnerability in the file /admin/session.php . The ID parameter can be manipulated by an unauthenticated remote attacker to bypass access controls. The CVSS 3.1 score is 7.3 (HIGH) with low impact across c...

7.5CVSS7.2AI score0.00288EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/04 9:17 a.m.6 views

CVE-2026-85311

Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60...

5.3CVSS0.00176EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/04 9:17 a.m.4 views

CVE-2026-27432

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

5.4CVSS0.00185EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/04 9:17 a.m.5 views

CVE-2026-32480

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

5.3CVSS0.00176EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/04 9:15 a.m.3 views

CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

9.1CVSS5.9AI score
SaveExploits0References4
CVE
CVE
added 2026/09/04 9:15 a.m.24 views

CVE-2026-85184

@fastify/middie (a Fastify plugin for HTTP middleware) versions 9.1.0 through 9.3.3 are affected by a path-scoped middleware bypass. The root cause is a mismatch: middie evaluates the raw request target to decide whether to run path-scoped middleware, while the Fastify router resolves an absolute...

9.1CVSS5.4AI score0.00332EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/04 9:15 a.m.7 views

EUVD-2026-70979

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

9.1CVSS5.4AI score0.00332EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/04 9:05 a.m.6 views

EUVD-2026-70958

An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required permmodify or permmodifyorg permissions. The affected attribute deletion paths relied on organization membership checks performed by...

8.3CVSS5.4AI score0.00301EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/04 8:48 a.m.4 views

BIT-JOOMLA-2026-73372 Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2

Joomla! Core - 20260809 - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets...

5.1CVSS5.3AI score0.00208EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/04 8:47 a.m.5 views

BIT-JOOMLA-2026-73371 Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260808 - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items...

5.1CVSS5.3AI score0.00208EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/09/04 8:45 a.m.36 views

CVE-2026-27432 WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

5.4CVSS0.00185EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/04 8:45 a.m.8 views

CVE-2026-27432

The WP Rentals WordPress theme by sc Internet Vivoo is affected by an Authorization Bypass Through User-Controlled Key vulnerability (classified as an Insecure Direct Object Reference / IDOR ) in versions before 3.16.0 . The flaw allows exploitation of incorrectly configured access control securi...

5.4CVSS5.2AI score0.00185EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/04 8:45 a.m.6 views

EUVD-2026-70975

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

5.4CVSS5.2AI score0.00185EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/04 8:07 a.m.37 views

CVE-2026-85311 WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60...

5.3CVSS0.00176EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/04 8:07 a.m.5 views

EUVD-2026-70970

Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/04 8:07 a.m.10 views

CVE-2026-85311

CVE-2026-85311 is a Missing Authorization (Broken Access Control) vulnerability in the MarketKing WordPress plugin by Kings Plugins, affecting versions up to 2.1.60 . The flaw allows an unauthenticated remote attacker to exploit incorrectly configured access control security levels, resulting in ...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/04 8:06 a.m.6 views

WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin MarketKing versions = 2.1.60...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0Affected Software1
EUVD
EUVD
added 2026/09/04 8:02 a.m.5 views

EUVD-2026-70969

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/04 8:02 a.m.38 views

CVE-2026-32480 WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

5.3CVSS0.00176EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/04 8:02 a.m.7 views

CVE-2026-32480

CVE-2026-32480 affects the WCFM Membership WordPress plugin (by WC Lovers) in versions up to and including 2.11.11 . The vulnerability is a missing authorization (broken access control) flaw that allows exploitation of incorrectly configured access control security levels. The CVSS v3.1 score is ...

5.3CVSS5.2AI score0.00176EPSS
SaveExploits0References1
Rows per page
Query Builder