CVE-2023-46745

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions the login method has no rate limit. An attacker may be able to leverage this vulnerability to gain access to user account...

CVE-2023-36556

An incorrect authorization vulnerability CWE-863 in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests...

CVE-2023-2734

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated...

CVE-2022-3477

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address...

CVE-2019-14254

An issue was discovered in the secure portal in Publisure 2.1.2. Because SQL queries are not well sanitized, there are multiple SQL injections in userAccFunctions.php functions. Using this, an attacker can access passwords and/or grant access to the user account "user" in order to become...

CVE-2018-1000875

Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutable Data vulnerability in Website Terms of Service Acceptance Page that can result in Access to any user account. This attack appear to be...

CVE-2025-46745

CVE-2025-46745 affects Schweitzer Engineering Laboratories (SEL) software/Blueframe OS family where an authenticated user with lower privileges can view other users’ account information due to an improper privilege management/root-cause issue. Reported impact is information disclosure (confidenti...

PT-2025-20728 · Flytxt · Flytxt Neon-Dx

Name of the Vulnerable Software and Affected Versions: Flytxt NEON-dX version 0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c Description: The issue concerns the userId parameter in the change password function, allowing attackers to execute brute force attacks to discover user passwords. This could potential...

CVE-2025-2594 User Registration & Membership < 4.1.3 - Authentication Bypass

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID...

CVE-2024-10721 Store XSS in phpipam/phpipam

A stored cross-site scripting XSS vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the application, which can be executed in the context of other users who view the affected page. The issue occurs in the circuits...

CVE-2025-1667

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpspUpdateTeacher function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access a...

Linux Distros Unpatched Vulnerability : CVE-2022-38457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-freeUAF vulnerability was found in function 'vmwcmdrescheck' in drivers/gpu/vmxgfx/vmxgfxexecbuf.c in Linux kernel's vmwgfx driver with device file...

CVE-2025-27416

CVE-2025-27416 affects the Scratch-Coding-Hut.github.io sign-in page. The vulnerability described states that the sign-in form allows a user to sign into another user’s account, implying an account-authentication/authorization issue on the website. As published, there is no available fix and a fi...

CVE-2020-15164

in Scratch Login MediaWiki extension before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscores, since those are treated as whitespace and trimmed by MediaWiki. This affects all users on any wiki using this extension. Since versio...

CVE-2024-9501

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.0.7. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated...

CVE-2024-56320

GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the admin "Configuration XML" UI feature, and its associated API. A malicious insider/existing authenticated GoCD user with an existing GoCD...

CVE-2024-11281

CVE-2024-11281 affects WooCommerce Point of Sale for WordPress. The vulnerability arises from insufficient validation of the logged_in_user_id value when option values are empty, enabling change of email on arbitrary user accounts (including administrators) and password resets. Affected versions ...

The vulnerability of the Junos OS Evolved operating system, related to deficiencies in access control, allows a perpetrator to resume an earlier session and gain access to the user account.

The vulnerability of the Junos OS Evolved operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to resume a previous session and gain access to the user account...

CVE-2024-23189

Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to the users account, access to another account within the same context or an successful social engineering...

CVE-2024-23190

Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts...