220 matches found
WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion
WordPress Narnoo Distributor plugin 2.5.1 and prior is susceptible to local file inclusion. The plugin does not validate and sanitize the libpath parameter before being passed into a call to require via the narnoodistributorlibrequest AJAX action, and the content of the file is displayed in the...
CVE-2026-111631
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...
CVE-2026-111625
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...
CVE-2026-111628
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...
CVE-2026-111631 Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...
EUVD-2026-103053
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...
CVE-2026-111631
Distributor versions before 2.3.2 are vulnerable to a missing authorization flaw in external connection AJAX actions. This allows users with Contributor-level privileges to perform actions reserved for manage_options users. Specifically, an attacker can invoke dt_verify_external_connection with a...
EUVD-2026-103050
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...
CVE-2026-111628
10up Distributor versions before 2.3.2 are vulnerable to a PHP object injection flaw. The root cause is the double unsererialization of distributed post meta within the set_meta() function located in includes/utils.php. This allows users with Contributor-level privileges to store a serialized PHP...
CVE-2026-111625 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...
EUVD-2026-103047
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...
CVE-2026-111625 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...
CVE-2026-111625
The 10up Distributor software (versions before 2.3.2 ) contains a missing authorization vulnerability within the ajax_push() function. This flaw allows Contributor-level multisite users to publish posts on other network sites to which they do not have access. By utilizing a dt-push nonce combined...
PT-2026-116030
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage options users. Attackers can call dt verify external connection with a chosen endpointId and url to send stored connection...
PT-2026-116024
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax push that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sit...
PT-2026-116027
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set meta in includes/utils.php unserializes on the...
CVE-2026-79823
HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior...
CVE-2026-79823
The HPE NonStop EMS Distributor is vulnerable to a buffer overflow condition (CWE-1201), which may result in undesirable behavior . The affected software version is T9632L01^ACC and earlier . HPE has released a fix for this vulnerability; users should update to version T9632L01^ACE or later. No s...