CNVD-2022-27366__CVE-2023-37621

CVE ID CVE-2023-37621 PRODUCT Fronius Fronius Datalogger Web 2.0.5-4 VERSION Fronius Fronius Datalogger Web 2.0.5-4 PROBLEM TYPE Unauthorized access vulnerability DESCRIPTION Fronius is a European welding machine manufacturer. Unauthorized access to Fronius Datalogger Web allows attackers to gain...

CVE-2026-108374 ERPNext: Unauthorised status modification due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

CVE-2026-108374

The ERPNext enterprise resource planning tool is vulnerable to unauthorised status modification in versions prior to 15.121.0 and 16.34.0 . The root cause is a missing authorization check in certain endpoints used for status modification. A low-privileged authenticated user can bypass required wr...

CVE-2026-108374 ERPNext: Unauthorised status modification due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

EUVD-2026-98007

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...

CVE-2026-109613

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...

CVE-2026-109669

The Frappe ERPNext software is vulnerable to a missing authorization flaw in versions prior to 15.110.0 and 16.x before 16.21.0 . The root cause is that certain endpoints fail to enforce proper authorization checks when modifying record statuses. This allows authenticated low-privileged users to ...

CVE-2026-109669 Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted...

CVE-2026-109669 Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted...

CVE-2026-109628 Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted...

CVE-2026-109628 Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted...

CVE-2026-109613 Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...

CVE-2026-109613

The Frappe ERPNext platform is affected by a missing authorization vulnerability (CWE-862) in versions prior to 15.121.0 and 16.x before 16.34.0 . The root cause is that certain endpoints fail to enforce proper authorization checks when modifying document statuses. This allows authenticated low-p...

CVE-2026-109613 Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...

EUVD-2026-95708

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and...

WordPress Kirki plugin 6.0.0-6.2.5 - Authenticated Collaboration Comment Status Modification vulnerability

Authenticated Collaboration Comment Status Modification vulnerability discovered by Revanth Meesala in WordPress Plugin Kirki versions 6.0.0-6.2.5...

CVE-2026-84225

The Kirki WordPress plugin versions 6.0.0 through 6.2.5 is vulnerable to an Authorization Bypass via IDOR . The plugin fails to verify if a user is authorized to modify a collaboration comment before changing its state. This allows users granted content-level access to the page builder to modify ...

CVE-2026-12654 Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...

CVE-2026-12973

The PayPlus Payment Gateway WordPress plugin, in versions before 8.2.2 , contains a vulnerability where it fails to perform authorization or order-ownership validation for a specific AJAX action . This flaw is accessible to unauthenticated users , potentially allowing them to disclose the secret ...

CVE-2026-12973 PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...