CVE-2024-10448

Affected Version: BloodBank Management System : 1.0 Vulnerability Information: Vulnerability Type: Cross Site Request Forgery CSRF Severity: HIGH Status: Unpatched Vulnerable Endpoint: Path: /file/delete.php?bid= Vulnerability Description: A Cross Site Request Forgery CSRF vulnerability was...

CVE-2026-118645

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get...

CVE-2026-118645 n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get...

CVE-2026-118645

The automation platform n8n is vulnerable to a filter injection vulnerability in the Quick Base node . This issue occurs because the node sends the "Where" filter to the Quick Base API as raw query text . Affected versions include before 1.123.85 , 2.x before 2.43.5 , and 2.44.x before 2.44.1 . A...

CVE-2026-55387

The InvoiceShelf web and mobile application (version 2.3.3 and earlier ) is vulnerable to an improper access control flaw during bulk-delete operations. The issue stems from the fact that validators for several request types—including DeleteCustomersRequest , DeleteEstimatesRequest , DeleteExpens...

EUVD-2026-101609

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's...

CVE-2026-96900 Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that...

CVE-2026-108624 JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remov...

CVE-2026-108615 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other user...

WordPress Shipping for Nova Poshta plugin 1.18.7-1.19.8 - Unauthenticated Order Shipment Record Deletion vulnerability

Unauthenticated Order Shipment Record Deletion vulnerability discovered by Emiliano Carrizo in WordPress Plugin Shipping for Nova Poshta versions 1.18.7-1.19.8...

EUVD-2026-83674

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

CVE-2026-92410 Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

CVE-2026-92425

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...

CVE-2026-93762

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanent...

EUVD-2026-83203

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanent...

CVE-2026-93765

Mongoid (Ruby ODM for MongoDB) has an unsafe reflection weakness in the document persistence layer. Unvalidated method-name dispatch in the atomic pop operation allows an unauthenticated party—via keys passed through an embedding application—to trigger unintended internal method invocations inste...

PT-2026-86408

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk actions' function. This makes it possible for authenticated attackers, with...

CVE-2026-13175

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

PT-2026-78298

Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7 Description Insufficient authorization checks in an AJAX action allow unauthenticated users to delete arbitrary appointment records, including associated booking items and payment records. This occurs through...

EUVD-2026-57106

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...