CVE-2024-11283 WP JobHunt <= 7.1 - Authentication Bypass to Candidate

The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wpajaxgoogleapilogincallback function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to...

CVE-2024-11283 WP JobHunt <= 7.1 - Authentication Bypass to Candidate

The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wpajaxgoogleapilogincallback function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to...

CVE-2024-11286

CVE-2024-11286 concerns WP JobHunt for WordPress, where versions up to 7.1 are vulnerable to an authentication bypass. The root cause, as described in the initial document, is that the plugin does not properly verify a user’s identity before authenticating via cs_parse_request(), allowing unauthe...

SUSE CVE-2025-27509

fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time JIT provisioning is enabled, or create new...

WordPress plugin WP JobHunt 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WP JobHunt...

PT-2025-11254

Name of the Vulnerable Software and Affected Versions: Civi - Job Board & Freelance Marketplace WordPress Theme plugin versions up to, and including, 2.1.4 Description: The issue is due to a lack of user validation before changing a password, making it possible for unauthenticated attackers to...

Application Accounts Manager 1.0 Cross Site Scripting

Application Accounts Manager version 1.0 suffers from a persistent cross site scripting vulnerability. Exploit Title: Stored XSS on application-accounts-manager 1.0 Date: 03.14.2025 Exploit Author: Ümit AYAZ Vendor Homepage: www.sourcecodester.com Software Link:...

Rising Technosoft CAP back office application 安全漏洞

Rising Technosoft CAP back office application is a back office application from Rising Technosoft India. A security vulnerability exists in the Rising Technosoft CAP back office application that stems from improper authentication checks in the API endpoint, allowing an unauthenticated, remote...

Rising Technosoft CAP back office application 安全漏洞

Rising Technosoft CAP back office application is a back office application from Rising Technosoft India. A security vulnerability exists in the Rising Technosoft CAP back office application that stems from improper authorization checking in certain API endpoints, which allows an authenticated,...

Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover

Summary the vulnerability is that users such as resellers or customers are able to create accounts with the same email address as an existing account e.g., if the admin has [email protected], others can also create an account using the same email. This creates potential issues with account...

CVE-2024-13580 XV Random Quotes <= 1.40 - Settings Reset via CSRF

The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack...

keycloak-ldap-federation: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak

A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD...

TikTok: Chain Vulnerability lead to Full Control Group Live Accounts & Undeletable Creator

A vulnerability was discovered in a TikTok LIVE backend platform that could have allowed a user to gain access controls beyond their account privileges. The vulnerability was reported by @eneri...

CVE-2025-1315

The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to...

The vulnerability of the ManageEngine ADSelfService Plus password reset software, related to deficiencies in authentication procedures, allows a malicious individual to gain access to user accounts.

The vulnerability of the ManageEngine ADSelfService Plus password reset software is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain access to user accounts remotely...

CVE-2025-26318

hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application...

PT-2025-9910 · Unknown · Unifiedtransform

Name of the Vulnerable Software and Affected Versions: Unifiedtransform version 2.0 Description: The issue is related to incorrect access control in Unifiedtransform, leading to privilege escalation. This allows teachers to update the personal data of fellow teachers. Recommendations: For...

SonicWall HTTP Login Scanner

This module adds HTTP Login scanning for SonicWall NSv. It allows scanning both admin and user accounts. Module Options msf use auxiliary/scanner/sonicwall/loginscanner msf auxiliaryloginscanner show actions ...actions... msf auxiliaryloginscanner set ACTION msf auxiliaryloginscanner show options...

CVE-2025-27583

Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows create and modify user accounts, including an Administrator account...

WordPress plugin WP Real Estate Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...