CVE-2026-81278 WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

CVE-2026-52730

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-52730

Xibo CMS prior to version 4.4.3 contains a missing authorization vulnerability in Module::settingsForm caused by PHP operator precedence . This allows an authenticated user with the Module View feature—which is not granted to non-admins by default—to view (but not change) super admin-restricted m...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-78076

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on commenus.item.id or core.admin. An authenticated use...

CVE-2026-51673

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68528

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on commenus.item.id or core.admin. An authenticated use...

CVE-2026-78076 Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on commenus.item.id or core.admin. An authenticated use...

CVE-2026-78076 Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on commenus.item.id or core.admin. An authenticated use...

EUVD-2026-68536

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84052

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.8 Description An unauthenticated path traversal issue exists in the Settings component. The writeTraefikConfigInPath function within the packages/server/src/utils/traefik/application.ts file fails to properly...

CubeCart 6.7.4 - SQL injection

Exploit Title: CubeCart 6.7.4 - SQL injection Date: 2026-06-08 Exploit Author: Mikail Kocadağ Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE: CVE-2026-54647 Advisory / References:...

The vulnerability of the Content Settings component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to compromise data integrity.

The vulnerability of the Content Settings component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability allows a malicious actor to manipulate data integrity through a specially created HTML page...

CVE-2026-77008

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions...

CVE-2026-17522

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

EUVD-2026-68055

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions...

CVE-2026-77008

CVE-2026-77008 affects the HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through version 1.0.3 . The root cause is a missing authentication/authorization check on the plugin's settings-saving endpoint, allowing any unauthenticated user to overwrite the stored configuration. ...

CVE-2026-77008 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings Update

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions...

EUVD-2026-68054

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...