CVE-2026-72709

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

DEBIAN-CVE-2026-72709

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

CVE-2026-72709

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

UBUNTU-CVE-2026-72709

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

EUVD-2026-76155

SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser. Attacker...

CVE-2026-72709

SPIP before 4.4.18 is affected by a missing authorization vulnerability in the administrative action endpoints under ecrire/action/. The root cause is the absence of a server-side permission check via autoriser(): an unauthenticated attacker can obtain a valid HMAC-SHA256 nonce, compute it for an...

CVE-2026-72709 SPIP < 4.4.18 Missing Authorization via ecrire/action/

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

EUVD-2026-75887

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

CVE-2026-81905

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

PT-2026-89912

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description An authorization flaw exists in sensitive actions located under the 'ecrire/action/' endpoint. Unauthenticated attackers can invoke privileged actions by providing a valid CSRF Cross-Site Request Forge...

CVE-2026-81905 Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

CVE-2026-81905 Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

CVE-2026-81905

Concrete CMS versions below 9.5.3 store user validation hashes (email/registration validation, password reset, persistent login) in a single table with a type column, but the redemption path resolves a hash by value alone without verifying its type . This allows a long-lived registration hash (60...

CVE-2026-81905 Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Flow Bypass Lab...

WordPress Bulk Password Reset plugin <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset vulnerability

Authenticated Subscriber+ Arbitrary Password Reset vulnerability discovered by Afan, moonge in WordPress Plugin Bulk Password Reset versions = 1.3.3...

CVE-2026-14873

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

CVE-2026-14873 Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

CVE-2026-14873

The Bulk Password Reset plugin for WordPress is affected in all versions up to and including 1.3.3 by a privilege escalation vulnerability. The plugin fails to properly validate a user's identity before updating account details, allowing an authenticated attacker with subscriber-level access or a...

EUVD-2026-75241

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...