13775 matches found
PT-2025-42984
Name of the Vulnerable Software and Affected Versions Oracle Essbase version 21.7.3.0.0 Description An issue exists in Oracle Essbase, specifically within the Essbase Web Platform component. A low-privileged attacker with network access via HTTP can compromise the system. Successful exploitation...
PT-2025-42960
Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft versions 8.60 through 8.62 Description An easily exploitable issue exists in the PeopleSoft Enterprise PeopleTools PIA Core Technology component. A low-privileged attacker with network access via HTTP can compromise the syste...
Work Examiner Professional 安全漏洞
Work Examiner Professional is an employee computer monitoring software from Work Examiner USA. A security vulnerability exists in Work Examiner Professional that stems from the use of weakly hard-coded credentials by the FTP server, which could lead to data modification or reading and remote code...
PT-2025-42945
Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft versions 8.60 through 8.62 Description A flaw exists within the Rich Text Editor component of Oracle PeopleSoft Enterprise PeopleTools. This issue allows a low-privileged attacker with network access via HTTP to compromise th...
PT-2025-42938
Name of the Vulnerable Software and Affected Versions Oracle iStore versions 12.2.5 through 12.2.14 Description An easily exploitable issue exists in the Oracle iStore Shopping Cart component of Oracle E-Business Suite. An unauthenticated attacker with network access via HTTP can compromise Oracl...
GLPI Authentication Bypass
The vulnerability of the GLPI system for requests, incidents, and inventory management involves bypassing authentication using a password. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access and modify protected information...
EUVD-2025-34984
The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversatio...
CVE-2025-11372
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin Tools REST endpoints which are registered with permissioncallback set to returntrue. This makes it...
CVE-2025-11372
CVE-2025-11372 affects the LearnPress – WordPress LMS Plugin (WordPress) up to and including version 4.2.9.3. The root cause is missing capability checks on Admin Tools REST endpoints, with permission_callback set to __return_true, enabling unauthenticated attackers to perform destructive databas...
WordPress plugin ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress plugin...
PT-2025-42705
Name of the Vulnerable Software and Affected Versions Kognetiks Chatbot plugin for WordPress versions prior to 2.3.6 Description The Kognetiks Chatbot plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check in several functions. This allows...
CVE-2025-11378: Missing Authorization
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'shortpixelajaxRequest' AJAX action in all versions up to, and including, 6.3.4. This makes it possible for...
VulnCheck KEV: CVE-2025-11372
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin Tools REST endpoints which are registered with permissioncallback set to returntrue. This makes it...
PT-2025-42695
Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin versions up to and including 4.2.9.2 Description The LearnPress – WordPress LMS Plugin is susceptible to data modification due to absent capability checks on Admin Tools REST endpoints. These endpoints are...
WordPress plugin FileBird 授权问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. An authorizati...
CVE-2025-10849
The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processpluginactions' function called via an AJAX action in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to activate ...
VulnCheck KEV: CVE-2024-5276
A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this...
CVE-2025-58424
On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message integrity protection. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2025-11728
The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'returnpayment' and 'noticepayment' functions in all versions up to, and including, 6.0. This makes it possibl...
CVE-2025-10849
The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processpluginactions' function called via an AJAX action in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to activate ...