WordPress Secure Custom Fields plugin < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update vulnerability

Contributor+ Admin-Restricted Custom Field Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Secure Custom Fields versions 6.9.8...

WordPress Advanced Custom Fields (ACF®) plugin 6.2.0-6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects vulnerability

Contributor+ Relationship Field Update on Arbitrary Objects vulnerability discovered by vuxvinh in WordPress Plugin Advanced Custom Fields versions 6.2.0-6.8.10...

WordPress Advanced Custom Fields (ACF®) plugin < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update vulnerability

Contributor+ Admin-Restricted Custom Field Update vulnerability discovered by vuxvinh in WordPress Plugin Advanced Custom Fields versions 6.8.11...

CVE-2026-97191

The Advanced Custom Fields (ACF®) WordPress plugin versions before 6.8.11 contains a vulnerability where it fails to re-apply field-group location rules during the post editor save path. This allows users with contributor-level access and above to bypass restrictions and write custom fields that ...

PT-2026-136004

Name of the Vulnerable Software and Affected Versions BuddyPress XProfile Image Field versions prior to 3.1.1 Description Unauthenticated attackers can delete arbitrary files on the server by submitting a zero-byte file via the field N hidden parameter during the registration process. This occurs...

WordPress ACF Frontend Admin by DynamiApps plugin <= 3.29.13 - Unauthenticated ACF Options Page Field Update vulnerability

Unauthenticated ACF Options Page Field Update vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.13...

VulnCheck KEV: CVE-2026-6228

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the adminform post type. The...

CVE-2026-71403

A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's username and principalIds fields. A user holding the update verb on users.management.cattle.io could inject a foreign identity provider principal into any account, so that the next log...

CVE-2026-49976 Snipe-IT: User Account Escalation via CSV Import

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

GHSA-R945-H4VM-H736 Grav API Privilege Escalation to Super Admin

Summary An insecure direct object reference and logic flaw in the Grav API plugin UsersController::update allows any authenticated user with basic API access api.access to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator...

CVE-2025-12937

The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'acfflmupdatetemplatewithpastedlayout' function in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers to...

WordPress ACF Flexible Layouts Manager plugin <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update vulnerability

Missing Authorization to Unauthenticated Custom Field Update vulnerability discovered by Ahmad Salem a7mad.cc in WordPress Plugin ACF Flexible Layouts Manager versions = 1.1.6...

PT-2025-41911

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A Stored Cross-Site Scripting issue exists that could allow a malicious user to view and modify sensitive data or make the webpage unavailable. The issue is due...

EUVD-2022-3241

Malicious code in bioql PyPI...

EUVD-2022-37587

Malicious code in bioql PyPI...

CVE-2022-34635

The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.fs field is set to Dirty...

CVE-2025-27089

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the update action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is...

WordPress plugin ACF On-The-Go has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the helperensureconfirmed call in managecustomfieldupdate.php, where the custom field name is not properly sanitized. An attacker can inject malicious scripts...

GHSA-CVRM-CR3M-QJ92 MantisBT XSS in manage_custom_field_update.php

An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...