CVE-2024-8289

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the updateitempermissionscheck and createitempermissionscheck functions in all...

CVE-2025-24968

CVE-2025-24968 — reNgine is affected by an unrestricted project deletion vulnerability. According to PT Security and Red Hat entries, attackers with specific roles (e.g., penetration tester , auditor ) can delete all projects, potentially enabling a complete system takeover via redirection to the...

reNgine 访问控制错误漏洞

reNgine is an automated reconnaissance framework for web applications from the individual developer Yogesh Ojha. Focused on a highly configurable streamlined reconnaissance process supported by an engine, reconnaissance data correlation and organization, continuous monitoring, supported by a...

WordPress User Role plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin User Role versions = 1.0...

Incorrect Authorization

Overview zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Incorrect Authorization due to improper RBAC enforcement. Remediation Upgrade zenml to version 0.72.0 or higher. References - GitHub Commit - GitHub PR...

CVE-2024-12768 Responsive iframe <= 1.2.0 - Contributor+ Stored XSS

The Responsive iframe WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-12768 Responsive iframe <= 1.2.0 - Contributor+ Stored XSS

The Responsive iframe WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-53357

Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers, with low privileges, to 1 add an admin user via the /api/user/addalias route; 2 modifiy a user via the /api/user/updatealiasroute; 4 delete users via the /api/user/delali...

CVE-2024-53355

Multiple incorrect access control issues in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers, with low privileges, to 1 add an admin user via the /api/user/addalias route; 2 modifiy a user via the /api/user/updatealias route; 4 delete users via the...

CVE-2024-13101 WP MediaTagger <= 4.1.1 - Contributor+ Stored XSS

The WP MediaTagger WordPress plugin through 4.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-13101

CVE-2024-13101 affects the WordPress plugin WP MediaTagger (versions up to 4.1.1). The vulnerability arises because shortcode attributes are not properly validated or escaped before they are output on the page, enabling a Stored Cross-Site Scripting (XSS) attack for users with the contributor rol...

CVE-2024-13101 WP MediaTagger <= 4.1.1 - Contributor+ Stored XSS

The WP MediaTagger WordPress plugin through 4.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2025-2959 · Easyvirt · Easyvirt Dcscope +1

Name of the Vulnerable Software and Affected Versions: EasyVirt DCScope versions 8.6.0 and earlier EasyVirt CO2Scope versions 1.3.0 and earlier Description: The issue allows remote authenticated attackers with low privileges to perform various unauthorized actions. This includes adding an admin...

WordPress Single-user-chat plugin <= 0.5 - Authenticated (Subscriber+) Limited Options Update vulnerability

Authenticated Subscriber+ Limited Options Update vulnerability discovered by Colin Xu in WordPress Plugin Single-user-chat versions = 0.5...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the execute functions in ServerSuspendHandler.java and ServerResumeHandler.java, which do not perform sufficient checks for the authorization of the running user. This allows a user with the Monitor or Auditor...

GHSA-FCRW-MPHX-7CXF Duplicate Advisory: Wildfly Server Role Based Access Control (RBAC) provider has Improper Access Control

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qr6x-62gq-4ccp. This link is maintained to preserve external references. Original Description A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control...

CVE-2025-23367

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2025-23367

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2025-23367 Org.wildfly.core:wildfly-server: wildfly improper rbac permission

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2025-23367 Org.wildfly.core:wildfly-server: wildfly improper rbac permission

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...