46991 matches found
CVE-2026-65931: Missing Authorization
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...
PT-2026-82444
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
PT-2026-82474
Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...
CVE-2026-37071: Improper Privilege Management
Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...
CVE-2026-80207: Missing Authentication for Critical Function
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the...
CVE-2026-32566: Incorrect Privilege Assignment
Unauthenticated Privilege Escalation in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32564: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
The vulnerability of the SQLite driver software used by Adminer for database management allows a hacker to gain access to delete any files they desire.
The vulnerability of the SQLite driver software used by Adminer for database management involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability allows a malicious actor to gain access and delete any files by sending a specially crafted POST request...
CVE-2026-77035: Authorization Bypass Through User-Controlled Key
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...
PT-2026-82562
FrontAccounting through 2.4.20 generates a CSRF token in end form in includes/ui/ui controls.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/change current user password.php call check csrf token to validate it. No financial transaction...
CVE-2026-30073: Allocation of Resources Without Limits or Throttling
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...
CVE-2026-37068
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...
CVE-2026-37064
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...
CVE-2026-37073: Improper Access Control
Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...
CVE-2026-37068: Improper Limitation of a Pathname to a Restricted Directory
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...
PT-2026-82445
Name of the Vulnerable Software and Affected Versions ACPT Pro - Custom Post Types Plugin for WordPress versions prior to 2.0.64 Description An unauthenticated privilege escalation issue allows an attacker to create a WordPress administrator account. This flaw has been exploited in the wild via t...
CVE-2026-30073
The free5gc v4.0.1 software contains a vulnerability in the NssaiAvailabilitySubscriptionCreate component. An attacker can trigger a Denial of Service (DoS) by sending a crafted POST request . The RAPID7 documentation indicates that the underlying cause is an Allocation of Resources Without Limit...
PT-2026-82537
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...
CVE-2026-37067
Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...
