PT-2025-53323

V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the user role parameter. Attackers can send a crafted HTTP POST request to the user management endpoint with 'user role mod' set to integer value...

EUVD-2021-14149

Malware in sbrugna...

EUVD-2021-11561

Malware in sbrugna...

EUVD-2025-28212

Malicious code in bioql PyPI...

EUVD-2024-50618

Malicious code in bioql PyPI...

EUVD-2021-34172

Malicious code in bioql PyPI...

EUVD-2022-42796

Malicious code in bioql PyPI...

CVE-2025-8791

CVE-2025-8791 affects LitmusChaos up to version 3.19.0. The vulnerability is an improper authorization flaw in the /auth/list_projects endpoint caused by manipulating the role parameter, enabling remote, unauthenticated-like actions with low privileges. Exploitation is possible and the exploit ha...

CVE-2022-4016

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins...

CVE-2025-48373 Schule Has Client-Side Role-Based Access Control (RBAC) Bypass Vulnerability

Schule is open-source school management system software. The application relies on client-side JavaScript index.js to redirect users to different panels based on their role. Prior to version 1.0.1, this implementation poses a serious security risk because it assumes that the value of data.role is...

CVE-2025-3906

The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wepopcoes' function in all versions up to, and including, 1.7.5. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-33500

A vulnerability has been identified in Mendix Applications using Mendix 10 All versions = V9.3.0 V9.24.22. Affected applications could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a targe...

Any of the role setter , nominee Vetter should not be a council (cohort) member.

Lines of code Vulnerability details Impact The privileged cohort membercouncil member can influence the member addition, removal, rotating the nominee and excluding the nominee. The function of election can be rigged, arbitrary proposals can be passed. This is easy by the council member who has...

CVE-2021-4345 uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion

The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on the UlistingUserRole::saveroleapi method in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to remove or add roles, and add capabilities...

CVE-2021-24649 WP User Frontend < 3.5.29 - Obscure Registration as Admin

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via...

CVE-2021-25931

CVE-2021-25931 describes a CSRF vulnerability in OpenNMS Horizon (opennms-1-0-stable up to 27.1.0-1) and OpenNMS Meridian (meridian-foundation-2015.1.0-1 to 2020.1.6-1) where there is no CSRF protection for the endpoint /opennms/admin/userGroupView/users/updateUser. The flaw enables an attacker t...

Design/Logic Flaw

A vulnerability has been identified in Mendix Applications using Mendix 7 All versions V7.23.19, Mendix Applications using Mendix 8 All versions V8.17.0, Mendix Applications using Mendix 8 V8.12 All versions V8.12.5, Mendix Applications using Mendix 8 V8.6 All versions V8.6.9, Mendix Applications...

Siemens Mendix Elevation of Privilege Vulnerability

Siemens Mendix is a low-code application development platform from Siemens. The platform provides application development, testing, deployment and iteration. An elevation of privilege vulnerability exists in Siemens Mendix. An attacker could use the vulnerability to gain administrative privileges...

CVE-2021-24158

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

PT-2021-15703 · Themeisle · Orbit Fox

Name of the Vulnerable Software and Affected Versions: Orbit Fox by ThemeIsle affected versions not specified Description: The issue concerns a registration form feature in Orbit Fox by ThemeIsle that integrates with Elementor and Beaver Builder page builders. Administrators can set a default use...