CVE-2026-116204 YesWiki before 4.7.0 CSRF via despam Admin Action

YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action tools/security/actions/despam.php that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so a...

CVE-2026-116204

YesWiki versions prior to 4.7.0 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within the despam action (tools/security/actions/despam.php). This flaw allows unauthenticated attackers to perform unauthorized actions, such as deleting or restoring pages, by tricking an authent...

EUVD-2026-109462

YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action tools/security/actions/despam.php that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so a...

CVE-2026-110019

The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-110019: Missing Authorization

The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-110622

The Papermerge Core software (through version 3.5.3 ) is vulnerable to a missing authorization flaw in its page management and OCR endpoints. The root cause is that these endpoints fail to perform necessary has_node_perm checks, allowing authenticated users to access and manipulate data belonging...

CVE-2026-106029: Missing Authorization

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide...

EUVD-2026-92771

Ghost: Authorization Issue Allowed Author Role to Delete any Post...

Ghost: Authorization Issue Allowed Author Role to Delete any Post

Impact Staff with the Author role could delete posts and pages that they did not author. Vulnerable versions This vulnerability is present in Ghost from v5.81.0 up to v6.60.0. Patches v6.60.0 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost...

CVE-2026-105680

The Ghost Node.js content management system is vulnerable to an authorization issue in versions 5.81.0 through 6.60.0 . Staff members assigned the Author role can bypass intended restrictions to delete posts and pages that they did not originally author. This vulnerability is addressed in version...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-62386

The CVE-2026-62386 entry applies to Grav API plugin (getgrav/grav-plugin-api)

CVE-2026-62386

The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route JwtAuthenticator::extractBearerToken fallback. Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via th...

PT-2026-60650

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.0-rc.16 Description The plugin accepts JWT JSON Web Token access tokens via the token URL query parameter on every API route through the JwtAuthenticator::extractBearerToken fallback. This behavior causes...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the erasespamedcomments process. An attacker can permanently delete arbitrary wiki pages, including critical or administrative pages, by sending crafted POST requests containing a suppr array with targeted page...

CVE-2026-13126

The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing...

CVE-2026-44548

ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php causes a logged-in ChurchCRM user with the relevant role to silently delete records,...

CVE-2026-44548 ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)

ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php causes a logged-in ChurchCRM user with the relevant role to silently delete records,...

WordPress plugin WP Table Builder – Drag & Drop Table Builder security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

CVE-2025-55312

An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application may fail to properly update internal states. Subsequent annotation management operations assume these states are valid, causing dereferen...