18 matches found
WordPress Simple Membership plugin < 4.7.8 - Subscriber+ Membership Level Escalation vulnerability
Subscriber+ Membership Level Escalation vulnerability discovered by Charles Vosburgh in WordPress Plugin Simple Membership versions 4.7.8...
CVE-2026-88764 Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged...
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. Chromium security severity: Medium...
CVE-2026-55659
Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's nam...
EUVD-2018-8820
Malware in sbrugna...
EUVD-2015-5121
Malware in sbrugna...
EUVD-2019-18921
Malware in sbrugna...
EUVD-2022-34548
Malicious code in bioql PyPI...
CVE-2022-2273
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membershiplevel parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request...
CVE-2024-52946: Incorrect Default Permissions
An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticated user to raise their authentication level if the admin configured an "Adaptative authentication rule" with an increment instead of an absolute value...
OCS Inventory NG 2.3.0.0 - Unquoted Service Path
Exploit Title: OCS Inventory NG 2.3.0.0 - Unquoted Service Path Date: 2023/04/21 Exploit Author: msd0pe Vendor Homepage: https://oscinventory-ng.org Software Link: https://github.com/OCSInventory-NG/WindowsAgent My Github: https://github.com/msd0pe-1 Fixed in version 2.3.1.0 OCS Inventory NG...
PT-2022-15649 · WordPress · Simple Membership
Name of the Vulnerable Software and Affected Versions: Simple Membership WordPress plugin versions prior to 4.1.3 Description: The issue arises from improper validation of the membership level parameter when editing a profile. This allows members to potentially escalate to a higher membership lev...
CVE-2021-35052: Improper Privilege Management
A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High...
Design/Logic Flaw
user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3...
CVE-2018-17037
UCMS 1.4.6 contains a privilege-escalation vulnerability in user/editpost.php that lets an attacker move from user level 1 to superuser level 3. The root cause is described as the application mishandling privilege levels, enabling elevation without exploit specifics. Affected software: UCMS 1.4.6...
(Pwn2Own) Microsoft Windows WarpKMSubmitCommandVirtual Uninitialized Memory Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within BasicRender.sys,...
