16740 matches found
CVE-2026-112329
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...
CVE-2026-112328
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the addnewmoduleterm AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted courseid, since the handler validates only...
CVE-2023-34965
CVE-2023-34965 SSPanel UIM is a multi-purpose agency service sales management system specially designed for Shadowsocks / V2Ray / Trojan protocols. SSPanel-Uim version before 2023.3 does not restrict access to the /link/ interface,which can lead to a leak of user subscription information. Detail...
CVE-2026-112329 Sensei LMS 4.26.4 Broken Access Control via save_new_message
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...
CVE-2026-112329
The Sensei LMS WordPress plugin, versions prior to 4.26.4 , is vulnerable to a broken access control issue in the legacy save_new_message handler hooked on the init action. The vulnerability exists because the handler validates only a generic nonce without verifying course enrollment or restricti...
EUVD-2026-104388
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...
CVE-2026-112328 Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the addnewmoduleterm AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted courseid, since the handler validates only...
CVE-2026-112328
The Sensei LMS WordPress plugin (versions prior to 4.26.4 ) contains a broken access control vulnerability in the add_new_module_term AJAX handler . The root cause is that the handler validates only a generic nonce and checks manage_options for slug prefixing without verifying specific course edi...
EUVD-2026-104386
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the addnewmoduleterm AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted courseid, since the handler validates only...
CVE-2022-1329-WordPress-Elementor-3.6.0-3.6.1-3.6.2-Remote-Code-Execution-Exploit
WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Execution Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the...
CVE-2026-112222 WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744...
CVE-2026-112222
The WordPress Surfer plugin (versions
WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mor Golan in WordPress Plugin Surfer versions = 1.8.0.744...
CVE-2024-24409
CVE-2024-24409 - ADManager Plus Build 7210 Elevation of Privilege Vulnerability Description The Modify Computers is a predefined role in ADManager for managing computers. If a technician user has the Modify Computers privilege over a computer, they can change the userAccountControl and...
CVE-2026-111845 WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0...
CVE-2026-111845
The YITH WooCommerce Product Bundles plugin for WordPress (versions up to and including 2.29.0 ) is affected by a Missing Authorization vulnerability. This flaw allows for Exploiting Incorrectly Configured Access Control Security Levels , as the plugin fails to properly enforce authorization chec...
WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ratchanon Chamnankit in WordPress Plugin YITH WooCommerce Product Bundles versions = 2.29.0...
CVE-2026-111831 WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15...