fortinet-cve-2024-46671

CVE-2024-46671 0-day уязвимость, обнаруженная в FortiWeb waf версии 7.4.3 сборка 638GA Эксплойт В основном этот скрипт автоматизирует эксплуатацию аутентифицированной уязвимости IDOR, что приводит к удалению учетной записи и повторному созданию учетной записи по умолчанию без пароля из-за...

CVE-2026-92425

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin versions before 1.2.4 contain an insecure direct object reference (IDOR) caused by missing object-level authorization checks on several host-management operations. Any user holding the plugin's own administrator-assign...

CVE-2025-25967

CVE-2025-25967: 사이트 간 요청 위조CSRF DDSN Interactive cm3 Acora CMS 버전 10.1.1은 사이트 간 요청 위조CSRF에 취약합니다. 이 결함으로 인해 공격자는 외부 콘텐츠에 악의적인 요청을 삽입하여 인증된 사용자가 계정 삭제 또는 사용자 생성과 같은 승인되지 않은 작업을 수행하도록 속일 수 있습니다. CSRF 보호 기능이 없기 때문에 피해자의 활성 세션을 활용하는 조작된 요청을 통해 악용이 가능하며, 권한 오용 및 사용자 관리 기능의 잠재적 중단을 초래합니다. 영향받는 버전: Acor...

CVE-2023-43148

CVE-2023-43148 Автор: Aitor Herrero Fuentes Поставщик: SPA-Cart Домашняя страница поставщика: https://spa-cart.com/ Ссылка на ПО: https://demo.spa-cart.com/admin Версия: 1.9.0.3 Протестировано на: Windows 10 Pro CSRF УДАЛЕНИЕ ВСЕХ АККАУНТОВ Уязвимость межсайтовой подделки запросов CSRF в приложен...

EUVD-2023-60685

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts...

CVE-2026-86254 wger Incomplete Authorization Fix Cross-Tenant Account Deletion

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user...

CVE-2026-80208

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxi...

CVE-2026-80208

APITable through 1.13.0-beta.1 ships two internal endpoints (/api/v1/internal/getUserHistories and /api/v1/internal/users/{userId}/close) annotated with requiredLogin = false. Because the product's nginx gateway proxies all /api requests to the backend and the ResourceInterceptor returns before v...

EUVD-2026-67142

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxi...

CVE-2026-78360

A missing authorization flaw was found in Anitya. The user deletion endpoint checks that the caller is logged in but does not check that the caller is an administrator. Any authenticated user can delete arbitrary user accounts, including administrator accounts, which can remove administrative...

CVE-2026-13174

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

CVE-2026-13174 Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

CVE-2026-13174

The Eventin WordPress plugin before 4.1.21 has an IDOR flaw: contributor-level users can permanently delete other users' accounts. Update to 4.1.21 or later. No active exploitation reported. Patch via the Eventin plugin update page. Details: https://wpscan.com/vulnerability/849478d1-640f-49e0-8fa...

EUVD-2026-62260

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

CVE-2026-65984

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js...

CVE-2026-19716

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

EUVD-2026-57930

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

CVE-2026-19716 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

CVE-2026-18366

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any...

CVE-2026-18366 Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any...