2683 matches found
CVE-2019-13188
In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application...
CVE-2018-20335
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service via the /APPInstallation.asp?= URI...
CVE-2019-0153
Buffer overflow in subsystem in IntelR CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access...
CVE-2019-0092
Insufficient input validation vulnerability in subsystem for IntelR AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...
CVE-2019-0166
Insufficient input validation in the subsystem for IntelR AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable information disclosure via network access...
CVE-2019-17270
Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers disclos...
CVE-2025-0132
A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. The attacker must have network access to the Broker VM to exploit this issue...
WordPress Rozario Theme <= 1.4 is vulnerable to Broken Access Control
Software Rozario Type Theme Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-31065 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 039f36178658 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber...
CVE-2025-22844
Improper access control for some Edge Orchestrator software for IntelR Tiber™ Edge Platform may allow an unauthenticated user to potentially enable information disclosure via adjacent access...
CVE-2025-20062
Use after free for some IntelR PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potentially enable denial of service via adjacent access...
CVE-2025-22892
Uncontrolled resource consumption for some OpenVINO™ model server software maintained by IntelR before version 2024.4 may allow an unauthenticated user to potentially enable denial of service via adjacent access...
CVE-2025-1288
The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenticated user vulnerable to reflected XSS via a CSRF attack...
CVE-2024-6809 Simple Video Directory < 1.4.3 - Unauthenticated SQLi
The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
CVE-2024-13727
CVE-2024-13727 concerns the MemberSpace WordPress plugin, affected versions prior to 2.1.14. The issue is a reflected Cross‑Site Scripting (XSS) vulnerability caused by insufficient sanitization/escaping of a parameter before output in the page. The impact, as documented, is a reflected XSS that ...
CVE-2025-0132 Cortex XDR Broker VM: Unauthenticated User Can Disable Internal Services
A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. The attacker must have network access to the Broker VM to exploit this issue...
CVE-2025-46739
An unauthenticated user could discover account credentials via a brute-force attack without rate limiting...
CVE-2025-47292 Cap Collectif vulnerable to insecure deserialization leading to remote code execution
Cap Collectif is an online decision making platform that integrates several tools. Before commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, the DebateAlternateArgumentsResolver deserializes a Cursor, allowing any classes and which can be controlled by unauthenticated user. Exploitation of this...
Arbitrary Command Injection
Craft CMS is vulnerable to Arbitrary Command Injection. The vulnerability is due to unauthenticated user-supplied data being stored in session files without validation, potentially allowing PHP code injection into a predictable server file path...