WordPress Elementor Addon Elements plugin <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup vulnerability

Authenticated Contributor+ Sensitive Information Exposure via Modal Popup vulnerability discovered by Ankit Patel in WordPress Plugin Elementor Addon Elements versions = 1.13.10...

CVE-2024-57726

SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role...

The vulnerability of the Registration role module in Drupal CMS systems, related to incorrect privilege assignment, allows attackers to bypass security restrictions and enhance their privileges.

The vulnerability of the Registration role module in Drupal CMS systems is related to the improper assignment of privileges. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and enhance their privileges...

CVE-2025-0067

CVE-2025-0067 relates to SAP NetWeaver Application Server Java where a missing authorization check on service endpoints lets a user with a standard role create JCo connections used for remote function calls. The impact is described as low for confidentiality, integrity, and availability. Affected...

CVE-2025-0067 Missing Authorization check in SAP NetWeaver Application Server Java

Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on...

PT-2025-3868 · Unknown · Reckon Sppanadmin

Name of the Vulnerable Software and Affected Versions: reckcn SPPanAdmin version 1.0 Description: A cross-site scripting issue was found in the software, allowing for remote exploitation. The manipulation of the name argument in the "/;/admin/role/edit" file leads to this issue. Other parameters...

SPPanAdmin 代码注入漏洞

SPPanAdmin is a basic framework for backend management system by reckcn individual developers. A code injection vulnerability exists in SPPanAdmin version 1.0, which originates from the parameter name in the file /admin/role/edit that can lead to cross-site scripting...

CVE-2024-56114

Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorization checks. This feature is designated for supervisor role, but auditors have been able to successfully create audit templates from the...

CVE-2024-56114

Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorization checks. This feature is designated for supervisor role, but auditors have been able to successfully create audit templates from the...

CVE-2024-13251

Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1...

CVE-2024-13251 Registration role - Critical - Access bypass - SA-CONTRIB-2024-015

Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1...

CVE-2024-13251

The CVE-2024-13251 concerns the Drupal Registration role module. A logic/privilege-assignment error allows privilege escalation and affects Registration role versions 0.0.0 through 2.0.0, with the root cause linked to how upgrades and update.php handling were processed. The issue is mitigated by ...

CVE-2024-13251 Registration role - Critical - Access bypass - SA-CONTRIB-2024-015

Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1...

CVE-2024-13251 Registration role - Critical - Access bypass - SA-CONTRIB-2024-015

Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1...

CVE-2025-0333

A vulnerability, which was classified as critical, was found in leiyuxi cy-fast 1.0. Affected is the function listData of the file /sys/role/listData. The manipulation of the argument order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Registration role prior to version 2.0.1, which stems from the inclusion of a privilege assignment error vulnerability...

PT-2025-3830 · Unknown · Leiyuxi Cy-Fast

Name of the Vulnerable Software and Affected Versions: leiyuxi cy-fast version 1.0 Description: A critical vulnerability was found in the function listData of the file /sys/role/listData. The manipulation of the argument order leads to SQL injection. It is possible to launch the attack remotely...

CVE-2024-56114

CVE-2024-56114 affects Canlineapp Online 1.1 and is due to Broken Access Control in the create-audit-template feature. The underlying issue is improper authorization checks that allow users with the Auditor role to perform a task intended for the Supervisor role. Documented impact: auditors can c...

CVE-2024-56114

Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorization checks. This feature is designated for supervisor role, but auditors have been able to successfully create audit templates from the...

CVE-2024-10151

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...