CVE-2026-90933 laradashboard through 1.2.2 Missing Authorization via License API

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

CVE-2026-90933 laradashboard through 1.2.2 Missing Authorization via License API

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

By-Poloss..-..CVE-2026-11912

CVE-2026-11912: Simple File List = 6.3.7 - 인증 누출로 인한 인증되지 않은 파일 수정 요약...

EUVD-2026-77364

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory I...

CVE-2024-12172

CVE-2024-12172 WP Courses LMS – 在线课程构建器、电子学习课程、课程解决方案、教育课程 = 3.2.21 - 缺少授权，导致经过身份验证的（订阅者+）用户可任意更新用户元数据 描述 WP Courses LMS – 在线课程构建器、电子学习课程、课程解决方案、教育课程 WordPress 插件在 3.2.21 及之前的所有版本中，由于 wpcupdateusermetaoption 函数缺少权限检查，存在未授权访问漏洞。这使经过身份验证的攻击者（具有订阅者及以上权限）能够更新任意用户的元数据，当 wpcapabilities 被设置为 0...

Craftcms-PoC-CVE-2026-31266

CVE-2026-31266 - Craft CMS 권한 누락 CVE 정보 필드| 값 ---|--- CVE ID| CVE-2026-31266 공급업체| Pixel & Tonic 제품| Craft CMS 영향받는 버전| self::ALLOWANONYMOUSLIVE | self::ALLOWANONYMOUSOFFLINE, ; 개념 증명 root@kitploit: allowAdminChanges=false 설정 상태 curl -X POST "http://target/actions/app/migrate" 증거 공격 전:...

CVE-2026-33137

CVE-2026-33137 XWiki Platform - REST/wikis/wikiName 経由の認証なしXARインポート 説明 XWiki Platform の POST /wikis/wikiName REST API エンドポイントは、認証チェックや認可チェックを一切行わずに XAR（XWiki Archive）インポートを実行します。認証されていない攻撃者は、細工したXARファイルを送信することで、対象のwiki内に任意のドキュメントを作成または更新できます。 CVE : CVE-2026-33137 CWE : CWE-862 Missing...

CVE-2023-30486

CVE-2023-30486 Square = 2.0.0 - activatepluginを介した認可の欠落 説明 WordPress向けSquareテーマは、バージョン2.0.0以下において、AJAXアクションを介して呼び出されるactivateplugin関数に対するcapabilityチェックが欠如しているため、無許可のプラグインアクティベーションに対して脆弱です。これにより、サブスクライバーレベル以上のアクセス権を持つ認証済み攻撃者が任意のプラグインをアクティベートできる可能性があります。 root@kitploit: Missing Authorization CVSS...

By-Poloss..-..CVE-2026-12432-PoC

CVE-2026-12432: WP Full Stripe Free = 8.4.4 公開日 : 2026年6月26日 最終更新日 : 2026年6月27日 研究者 : Netwurm - VTDR e.V.i.G. 脆弱性の説明 WordPress用プラグインWP Full Stripe Freeは、バージョン8.4.3 （およびそれ以前）において、AJAXアクションwpfsupdatefailedpaymentstatusを介して認可の欠如 の脆弱性が存在します。 根本原因 脆弱なAJAXエンドポイントは、wpajax と wpajaxnopriv の両方のフックで登録されています...

PT-2026-91229

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...

EUVD-2023-60685

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts...

Linux Distros Unpatched Vulnerability : CVE-2026-72709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to...

CVE-2025-39459-Nuclei-Template

📄 CVE-2025-39459用Nucleiテンプレート 🚀 概要 このリポジトリは、Real Estate 7 WordPressテーマ における認証されていない権限昇格の脆弱性（CVE-2025-39459）を検出するために特別に設計されたNucleiテンプレートを提供します。この問題により、認証されていない攻撃者が脆弱なAJAXアクションを介して管理者として登録できるようになります。 🔍 脆弱性の説明 CVE-2025-39459 は、Real Estate 7 WordPressテーマ のバージョン3.5.2までのctaddnewmember...

CVE-2026-90595

A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed...

CVE-2026-90594

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...

CVE-2026-81648

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration an...

CVE-2026-90595 wxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorization

A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed...

CVE-2026-90595 wxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorization

A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed...

CVE-2026-90595

CVE-2026-90595 is a missing authorization flaw in wxiaoqi Spring-Cloud-Platform versions 1.0, 2.2, and 3.0. The vulnerability resides in the OnlineController.getOnlineInfo function within aceModules/ace-admin/auth/controller/OnlineController.java. A remote attacker with low privileges can exploit...

EUVD-2026-77093

A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed...