CVE-2024-10448

Affected Version: BloodBank Management System : 1.0 Vulnerability Information: Vulnerability Type: Cross Site Request Forgery CSRF Severity: HIGH Status: Unpatched Vulnerable Endpoint: Path: /file/delete.php?bid= Vulnerability Description: A Cross Site Request Forgery CSRF vulnerability was...

CVE-2026-55387

The InvoiceShelf web and mobile application (version 2.3.3 and earlier ) is vulnerable to an improper access control flaw during bulk-delete operations. The issue stems from the fact that validators for several request types—including DeleteCustomersRequest , DeleteEstimatesRequest , DeleteExpens...

EUVD-2026-101609

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's...

CVE-2026-96900 Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that...

WordPress Shipping for Nova Poshta plugin 1.18.7-1.19.8 - Unauthenticated Order Shipment Record Deletion vulnerability

Unauthenticated Order Shipment Record Deletion vulnerability discovered by Emiliano Carrizo in WordPress Plugin Shipping for Nova Poshta versions 1.18.7-1.19.8...

CVE-2026-92410 Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

EUVD-2026-83674

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

CVE-2026-92425

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...

CVE-2026-93762

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanent...

EUVD-2026-83203

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanent...

CVE-2026-93765

Mongoid (Ruby ODM for MongoDB) has an unsafe reflection weakness in the document persistence layer. Unvalidated method-name dispatch in the atomic pop operation allows an unauthenticated party—via keys passed through an embedding application—to trigger unintended internal method invocations inste...

PT-2026-86408

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk actions' function. This makes it possible for authenticated attackers, with...

CVE-2026-13175

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

PT-2026-78298

Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7 Description Insufficient authorization checks in an AJAX action allow unauthenticated users to delete arbitrary appointment records, including associated booking items and payment records. This occurs through...

EUVD-2026-57106

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...

CVE-2026-69703: Missing Authentication for Critical Function

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espaceadmin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actio...

PT-2026-67819

Name of the Vulnerable Software and Affected Versions Atlas-Livre affected versions not specified Description Improper access control exists within the admin controllers located under Espace admin/controleur/. Unauthenticated attackers can bypass session-based authentication guards by sending raw...

PT-2026-67069

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs...

CVE-2026-13729 Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request CSRF when a logged-in administrator is tricked into...

EUVD-2026-43134

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to missing capability checks and nonce verification on AJAX actions registered under both wpajax and wpajaxnopriv hooks, as the base...