565 matches found
CVE-2025-60375
CVE-2025-60375 CVE-2025-60375 — Authentication bypass / incorrect access control in PerfexCRM Note: Steps above are the original discovery steps reported by Ajansha Shankar and Ahamed Yaseen. References OWASP Authentication Cheat Sheet — gui...
BIT-GITLAB-2026-112378 Use of Less Trusted Source in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side...
CVE-2026-67187
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NFAbstractsList falls through to a validat...
CVE-2026-67187
The Ninja Forms plugin for WordPress (before version 3.15.4 ) is vulnerable to a server-side validation bypass in various list fields, including Checkbox List, Multi-Select List, Image List, Country, and State. The root cause is that NF_Abstracts_List falls through to a validate() method that fai...
CVE-2026-67187 Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NFAbstractsList falls through to a validat...
PT-2026-128261
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF Abstracts List falls through to a...
CVE-2026-67187: Improper Neutralization of Formula Elements in a CSV File
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NFAbstractsList falls through to a validat...
CVE-2026-112378
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side...
CVE-2026-112378 Use of Less Trusted Source in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side...
CVE-2026-112378
The GitLab EE software is affected by a vulnerability where an authenticated user could access paid AI features without a valid subscription. This is caused by insufficient server-side validation during billing eligibility checks (CWE-348 ). The issue impacts versions 17.8 before 19.3.6 , 19.4 be...
CVE-2026-112378 Use of Less Trusted Source in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side...
GitLab 17.8 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-112378)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated...
CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...
CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...
CVE-2026-18795
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x
PT-2026-99774
Name of the Vulnerable Software and Affected Versions Bookly WordPress plugin versions prior to 28.3 Description Insufficient server-side validation of client-supplied booking quantity values allows unauthenticated users to manipulate the appointment total. By reducing the total to zero, an...
PT-2026-96057
Name of the Vulnerable Software and Affected Versions RestroPress WordPress plugin versions prior to 3.4.6 Description Insufficient server-side validation of client-supplied item add-on prices occurs when items are added to or updated in the cart. This allows unauthenticated users to manipulate t...
SPIP SSRF
The vulnerability of the SPIP content management system is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...
CVE-2026-20286
A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...
CVE-2026-20285 Cisco Identity Services Engine Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...