3231 matches found
WordPress VOD Infomaniak plugin <= 1.5.9 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin VOD Infomaniak versions = 1.5.9...
CVE-2025-22800 WordPress Post SMTP plugin <= 2.9.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through = 2.9.11...
CVE-2024-46310
Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpoint...
Pat Infinite Solutions HelpdeskAdvanced 安全漏洞
Pat Infinite Solutions HelpdeskAdvanced is an automated solution for strategic governance of Service Management activities from Pat Infinite Solutions. A security vulnerability exists in Pat Infinite Solutions HelpdeskAdvanced version 11.0.33 and prior versions that stems from improper access...
CVE-2025-22449 Access control flaw for team admins allows unauthorized team additions
Mattermost versions 9.11.x = 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allowopeninvite" field via making their team public...
CVE-2025-22449
Mattermost Server 9.11.x ≤ 9.11.5 suffers an improper access-control flaw where team admins lacking invite permission can add users by toggling the allow_open_invite flag when a team is made public. Root cause: failure to enforce invite permissions. Affected feature/file: invite mechanism via all...
CVE-2025-22449 Access control flaw for team admins allows unauthorized team additions
Mattermost versions 9.11.x = 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allowopeninvite" field via making their team public...
Drupal 安全漏洞
Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Paragraphs table version 1.23.0 prior to version 2.0.0 through 2.0.2, which stems from insufficient granularity of access control vulnerabilities...
The vulnerability of the vibebp_register_user() function in the scenario included in the class.js file of the VibeBP plugin, a content management system for WordPress, allows a hacker to escalate their privileges.
The vulnerability of the vibebpregisteruser function in the class included in the class.js file of the VibeBP plugin, a content management system for WordPress, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to increase their privileges remotel...
CVE-2024-12033
The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the synclibraries function in all versions up to, and including, 4.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to sync libraries...
CVE-2024-54767
An access control issue in the component /juisboxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authentication. NOTE: this is disputed by the Supplier because it cannot be reproduced, and the issue report focuses on an unintended configuration wit...
PT-2025-3070 · Iptime · Iptime A2004
Name of the Vulnerable Software and Affected Versions: ipTIME A2004 version 12.17.0 Description: An access control issue in the component "/login/hostinfo2.cgi" of ipTIME A2004 allows attackers to obtain sensitive information without authentication. Recommendations: For ipTIME A2004 version...
D-Link DIR-816 A2 安全漏洞
The D-Link DIR-816 A2 is a wireless router from China's AUO D-Link. An access control error vulnerability exists in D-Link DIR-816 A2 version 1.10CNB05R1B011D88210, which stems from improper access control in /goform/form2NetSniper.cgi. An attacker can exploit this vulnerability to be able to set...
D-Link DIR-816 A2 安全漏洞
The D-Link DIR-816 A2 is a wireless router from China's AUO D-Link. An access control error vulnerability exists in D-Link DIR-816 A2 version 1.10CNB05R1B011D88210, which stems from improper access control in /goform/form2Dhcpd.cgi. An attacker can exploit this vulnerability to be able to set up...
D-Link DIR-816 A2 安全漏洞
The D-Link DIR-816 A2 is a wireless router from China's AUO D-Link. An access control error vulnerability exists in D-Link DIR-816 A2 version 1.10CNB05R1B011D88210, which stems from improper access control in /goform/form2AdvanceSetup.cgi. An attacker can exploit this vulnerability to set the 2.4...
D-Link DIR-816 A2 安全漏洞
The D-Link DIR-816 A2 is a wireless router from China's AUO D-Link. An access control error vulnerability exists in D-Link DIR-816 A2 version 1.10CNB05R1B011D88210, which stems from improper access control in /goform/form2LocalAclEditcfg.cgi. An attacker can exploit this vulnerability to be able ...
The vulnerability of software for monitoring, managing, and configuring VigorAP access points and VigorSwitches in the DrayTek VigorConnect local network lies in the lack of access control. This allows a malicious user to delete any files with root privileges.
The vulnerability of software for monitoring, managing, and configuring VigorAP access points and VigorSwitches in the DrayTek VigorConnect local network is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to delete any files with root privileges...
PT-2024-9845 · Jetbrains · Jetbrains Teamcity +1
Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.12 Description: The issue is related to improper access control in JetBrains TeamCity, which allowed viewing details of unauthorized agents. This could potentially enable a remote attacker to gain...
