3647 matches found
CVE-2025-42605 Improper Access Control Vulnerability in Meon Bidding Solutions
This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modification, or cancellation operations. An authenticated remote attacker could exploit this vulnerability by manipulating parameter in the API request body to...
WordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Premmerce Wholesale Pricing for WooCommerce versions = 1.1.10...
CVE-2025-46244
Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce linked-variation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Linked Variations for Woocommerce: from n/a through = 1.0.3...
CVE-2025-46232
CVE-2025-46232 affects the WordPress plugin “Alt Text AI” (Download Alt Text AI) and covers versions up to and including 1.9.93. The issue is a Missing/Misconfigured Authorization vulnerability, i.e., broken access control that could enable unauthorized access to protected functionality. The publ...
CVE-2025-43947
Codemers KLIMS 1.6.DEV lacks a proper access control mechanism, allowing a normal KLIMS user to perform all the actions that an admin can perform, such as modifying the configuration, creating a user, uploading files, etc...
TOTOLINK A3700R Access Control Error Vulnerability
The TOTOLINK A3700R is a wireless router that provides wireless network connectivity. TOTOLINK A3700R suffers from an access control error vulnerability that originates from improper access control of the setL2tpServerCfg function in the /cgi-bin/cstecgi.cgi file, for which no detailed...
Commvault Command Center 访问控制错误漏洞
Commvault Command Center is a graphical management interface from Commvault USA. An access control error vulnerability exists in Commvault Command Center version 11.38, which stems from a path traversal vulnerability that could lead to remote code execution...
TOTOLINK A3700R Improper Access Control Vulnerability
The TOTOLINK A3700R is a wireless router that provides wireless network connectivity. The TOTOLINK A3700R suffers from an improper access control vulnerability that stems from the setWiFiEasyCfg/setWiFiEasyGuestCfg functions in the /cgi-bin/cstecgi.cgi file failing to properly handle specific...
TOTOLINK A3700R Access Control Error Vulnerability
The TOTOLINK A3700R is a wireless router that provides wireless network connectivity. The TOTOLINK A3700R suffers from an access control error vulnerability that stems from the /cgi-bin/cstecgi.cgi file setWiFiEasyGuestCfg function failing to correctly handle a specific request. No detailed...
CVE-2025-28104
Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input...
CVE-2025-28059
An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. When an administrator deletes a user account, the backend fails to terminate active sessions and revoke...
CVE-2025-28059
CVE-2025-28059 affects Nagios Network Analyzer 2024R1.0.3. Root cause: improper session invalidation and stale token handling after user deletion, causing active sessions and API tokens to remain valid and grant access to restricted functions. Impact: unauthorized access to system resources. Expl...
CVE-2025-26968
Missing Authorization vulnerability in webbernaut Cloak Front End Email allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cloak Front End Email: from n/a through 1.9.5...
CVE-2025-24577
Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through = 5.5.0...
CVE-2025-24581 WordPress Instantio plugin <= 3.3.7 - Settings Change vulnerability
Missing Authorization vulnerability in Themefic Instantio instantio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instantio: from n/a through = 3.3.7...
CVE-2025-24577 WordPress Poll Maker plugin <= 5.5.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through = 5.5.0...
CVE-2025-24581
CVE-2025-24581 concerns the WordPress Instantio plugin (<= 3.3.7). The vulnerability is described as a Missing Authorization issue, stemming from misconfigured access control security levels that could allow unauthorized exploitation. Public records in multiple sources confirm affected softwar...
CVE-2025-24583 WordPress 12 Step Meeting List plugin <= 3.16.5 - Settings Change vulnerability
Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through = 3.16.5...
CVE-2025-24737 WordPress WP Helper Premium plugin <= 4.6.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mat Bao Corporation WP Helper Premium allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP Helper Premium: from n/a through 4.6.1...
CVE-2025-27310 WordPress Page and Post Lister plugin <= 1.2.1 - Arbitrary Content Deletion vulnerability
Missing Authorization vulnerability in Radius of Thought Page and Post Lister page-and-post-lister allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page and Post Lister: from n/a through = 1.2.1...