Privilege escalation

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processpostdata' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role...

CVE-2023-2494: Missing Authorization

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processpostdata' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role...

WordPress plugin Go Pricing - WordPress Responsive Pricing Tables 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Go Pricing - WordPres...

Design/Logic Flaw

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'checklicense' functions in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-2714 Groundhogg <= 2.7.9.8 - Missing Authorization to Update License

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'checklicense' functions in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-2714 Groundhogg <= 2.7.9.8 - Missing Authorization to Update License

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'checklicense' functions in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-2714

CVE-2023-2714 – Groundhogg WordPress plugin suffers from a missing capability check in the check_license function, allowing authenticated users with subscriber-level rights and above to modify license-related data to a valid license key. Affected versions are up to 2.7.9.8. Impact is unauthorized...

SALERT < 1.2.2 - Subscriber+ Missing Authorization

The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the salertsavesettingswithajax function...

PT-2023-23171

Name of the Vulnerable Software and Affected Versions DHIS2 Core versions 2.36 through 2.37.9.1 DHIS2 Core versions 2.36 through 2.38.3.1 DHIS2 Core versions 2.36 through 2.39.1.2 Description DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Usin...

PT-2023-2500 · Oracle · Oracle Health Sciences Inform

Name of the Vulnerable Software and Affected Versions: Oracle Health Sciences InForm versions prior to 6.3.1.3 Oracle Health Sciences InForm versions prior to 7.0.0.1 Description: The issue is related to insufficient input validation in the Core component of Oracle Health Sciences InForm, allowin...

GitHub Enterprise Server 授权问题漏洞

GitHub Enterprise Server is a U.S. GitHub open source application. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. GitHub Enterprise Server suffers from an authorization issue vulnerability that stems from...

thorsten/phpmyfaq vulnerable to business logic errors

thorsten/phpmyfaq prior to 3.1.12 allows users with edit-only permissions to add and delete categories and add FAQs. This has been fixed in 3.1.12...

CVE-2022-4937

The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...

CVE-2022-4940

The WCFM Membership plugin for WordPress is vulnerable to a Broken Access Control flaw in versions up to and including 2.10.0 . The root cause is a lack of capability checks on specific AJAX actions, specifically wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. This allow...

CVE-2022-4935 WCFM Marketplace <= 3.4.11 - Missing Authorization

The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...

CVE-2023-28686

Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive informati...

CVE-2023-28686

Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive informati...

CVE-2023-27578 Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check

Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insufficient permission check. Unsupported versions are likely affected as far back as the functionality of Visualizations/Pages exists. Due to thi...

CVE-2023-27578 Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check

Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insufficient permission check. Unsupported versions are likely affected as far back as the functionality of Visualizations/Pages exists. Due to thi...

Galaxy 安全漏洞

Galaxy is an open source platform for FAIR data analysis open-sourced by the Galaxy Project. A security vulnerability exists in Galaxy versions 22.01, 22.05, and all versions prior to 23.0, which stems from the ability to modify a page/visualization without authorization due to insufficient...