691 matches found
WordPress King Addons Flaw Under Active Attack Lets Hackers Make Admin Accounts
A critical security flaw impacting a WordPress plugin known as King Addons for Elementor has come under active exploitation in the wild. The vulnerability, CVE-2025-8489 CVSS score: 9.8, is a case of privilege escalation that allows unauthenticated attackers to grant themselves administrative...
WordPress FluentCart A New Era of eCommerce plugin <= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter vulnerability
Authenticated Administrator+ SQL Injection via 'groupKey' Parameter vulnerability discovered by Itthidej Aramsri Boeing777 in WordPress Plugin FluentCart versions = 1.3.1...
EUVD-2025-200285
In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new...
Cisco Catalyst Center Virtual Appliance Access Control Error Vulnerability
Cisco Catalyst Center Virtual Appliance is a network controller and automated management platform from the American company Cisco Cisco. The Cisco Catalyst Center Virtual Appliance suffers from an Access Control Error vulnerability that stems from insufficient validation of user input. An attacke...
CVE-2025-64064
Primakon Pi Portal 1.0.18 /api/v2/ppusers endpoint fails to adequately check user permissions before processing a PATCH request to modify the PPSECURITYPROFILEID. Because of weak access controls any low level user can use this API and change their permission to Administrator by using...
CVE-2025-64065
Primakon Pi Portal 1.0.18 exposes /api/V2/pp_udfv_admin to authenticated, low-privilege users via an access control flaw (Broken Function Level Authorization) and insecure design, enabling direct PATCH-based impersonation of arbitrary users, including Administrators, without password or admin tok...
CVE-2025-64299
LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes...
PT-2025-47251
Name of the Vulnerable Software and Affected Versions Multiple Roles per User plugin for WordPress versions up to and including 1.0 Description The Multiple Roles per User plugin for WordPress has a flaw that allows unauthorized data modification. This is due to a missing capability check within...
CVE-2025-56503
An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Administrator via replacing the uninstall file with a crafted binary in the installation folder. NOTE: this is disputed by the Supplier because replacing the...
WordPress Free Quotation plugin <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability
Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Ivan Cese in WordPress Plugin Free Quotation versions = 3.1.6...
EUVD-2021-23604
Malware in sbrugna...
EUVD-2019-18436
Malware in sbrugna...
EUVD-2016-9626
Malware in sbrugna...
EUVD-2011-3565
Malware in sbrugna...
EUVD-2016-10143
Malware in sbrugna...
EUVD-2019-3294
Malware in sbrugna...
EUVD-2019-7628
Malware in sbrugna...
EUVD-2017-10008
Malware in sbrugna...