12695 matches found
PT-2026-1490
Name of the Vulnerable Software and Affected Versions CyberChimps Responsive Addons for Elementor versions through 2.0.8 Description The software contains a missing authorization issue, allowing exploitation of incorrectly configured access control security levels. Recommendations Update Responsi...
CVE-2025-11370: Missing Authorization
The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'store' function of the...
CVE-2025-64425 Coolify has host header injection in forgot password
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request to a malicious value. The victim will...
CVE-2024-30461 WordPress Tumult Hype Animations plugin <= 1.9.11 - CSRF to XSS vulnerability
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Tumult Inc Tumult Hype Animations allows DOM-Based XSS.This issue affects Tumult Hype Animations: from n/a through 1.9.11...
CVE-2025-68014
Insertion of Sensitive Information Into Sent Data vulnerability in awethemes AweBooking awebooking allows Retrieve Embedded Sensitive Data.This issue affects AweBooking: from n/a through = 3.2.26...
CVE-2025-31044
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AA-Team Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 3.3.2...
CVE-2025-68850
CVE-2025-68850 describes a Missing Authorization vulnerability in the Sell Downloads plugin for WordPress (Sell Downloads, up to version 1.1.12). The issue, as listed, involves access control/configuration gaps that could permit unauthorized access to the plugin’s features or data. The CVSS 3.1 b...
WordPress Timetics plugin <= 1.0.46 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by daroo in WordPress Plugin Timetics versions = 1.0.46...
CVE-2025-15454
A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender.tsx of the component RSS Handler. The manipulation results in cross site scripting. The attack can be executed remotely. This attack is...
PT-2026-1212
Name of the Vulnerable Software and Affected Versions bg5sbk MiniCMS versions up to 1.8 Description A flaw exists in bg5sbk MiniCMS that can lead to improper authentication. The issue affects an unknown function within the Article Handler component, specifically in the file /mc-admin/post-edit.ph...
WordPress WP MapIt plugin <= 3.0.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin WP MapIt versions = 3.0.3...
WordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by John P in WordPress Theme Oneline Lite versions = 6.6...
CVE-2025-64122
Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller MSC allows Signature Spoofing by Key Theft.This issue affects Multi-Stack Controller MSC: through 2.5.1...
PT-2026-2158
Name of the Vulnerable Software and Affected Versions zlib versions up to and including 1.3.1.2 Description zlib versions up to and including 1.3.1.2 contain a global buffer overflow in the untgz utility. The TGZfname function uses an unbounded strcpy call to copy an attacker-supplied archive nam...
CVE-2025-66153
Missing Authorization vulnerability in merkulove Headinger for Elementor headinger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headinger for Elementor: from n/a through = 1.1.4...
CVE-2025-49339
Missing Authorization vulnerability in Digages Direct Payments WP direct-payments-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Direct Payments WP: from n/a through = 1.3.3...
CVE-2025-66158
Missing Authorization vulnerability in merkulove Gmaper for Elementor gmaper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmaper for Elementor: from n/a through = 1.0.9...
CVE-2025-62132
Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tasty Recipes Lite: from n/a through = 1.1.5...
CVE-2025-49356
Missing Authorization vulnerability in Mykola Lukin Orders Chat for WooCommerce orders-chat-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orders Chat for WooCommerce: from n/a through = 1.2.0...