CVE-2025-46747 Exposure of Sensitive System Information

An authenticated user without user-management permissions could identify other user accounts...

PT-2025-20719 · Schweitzer Engineering Laboratories · Sel Blueframe Os

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An authenticated user without user-management permissions could identify other user accounts. Recommendations: At the moment, there is no information about a newer version that contains a fi...

CVE-2025-46827 Graylog Allows Session Takeover via Insufficient HTML Sanitization

Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with...

Cisco IOS XE Wireless Controller software 访问控制错误漏洞

Cisco IOS XE Wireless Controller software is a wireless LAN controller from Cisco. The Cisco IOS XE Wireless Controller Software suffers from an Access Control Error vulnerability that stems from insufficient access control and can be exploited by an attacker to cause the deletion of arbitrary us...

CVE-2025-3281

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.1 via the createstripesubscription function, due to missing validation on the 'memberid' use...

CVE-2025-3281

The CVE-2025-3281 entry concerns the WordPress plugin “User Registration & Membership – Custom Registration Form, Login Form, and User Profile.” The root cause is insecure direct object reference due to missing validation on the member_id key in the create_stripe_subscription() function, enabling...

CVE-2025-1327

The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homeydeleteuseraccount' action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2025-24887 OpenCTI bypass of protected attribute update

OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the external flag on/off and change...

OpenCTI 安全漏洞

OpenCTI is an open source cyber threat intelligence platform from OpenCTI Open Source. A security vulnerability exists in OpenCTI versions prior to 6.4.8 through 6.4.10, which stems from a vulnerability that allows bypassing of allow/deny lists, and could lead to modification of immutable...

GHSA-X7WV-5QG4-VMR6 org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

Impact When a user with programming right edits a document in XWiki that was last edited by a user without programming right and contains an XWiki.ComponentClass, there is no warning that this will grant programming right to this object. An attacker who created such a malicious object could use...

Meon Bidding 安全漏洞

Meon Bidding is a bidding related solution from Meon India. Meon Bidding has a security vulnerability that stems from improper authorization controls on certain API endpoints, which could lead to unauthorized access to other user accounts...

Whistleblower: DOGE Siphoned NLRB Case Data

A security architect with the National Labor Relations Board NLRB alleges that employees from Elon Musk 's Department of Government Efficiency DOGE transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network...

CVE-2025-28103

CVE-2025-28103 affects laskBlog v2.6.1. The root cause is incorrect access control, enabling attackers to arbitrarily delete user accounts via a crafted request. The CVE entry notes a medium severity (CVSS v3.1: 6.4; Network exposure, Low confidentiality/integrity impact, no availability impact)....

FlaskBlog 安全漏洞

FlaskBlog is a simple blogging application built using Flask by Doğukan Ürker, an individual developer. A security vulnerability exists in FlaskBlog version 2.6.1, which stems from improper access control and could lead to arbitrary deletion of user accounts...

CVE-2025-28103

Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request...

CVE-2025-30257

Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account...

CVE-2025-26906

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows DOM-Based XSS.This issue affects WP Delete User Accounts: from n/a through = 1.2.3...

CVE-2025-30257

Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account...

CVE-2025-26906

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows DOM-Based XSS.This issue affects WP Delete User Accounts: from n/a through = 1.2.3...

CVE-2025-26906

CVE-2025-26906 affects the WordPress plugin WP Delete User Accounts (affected up to version 1.2.3). It enables DOM-based XSS due to improper neutralization during web page generation. Wordfence shows the vulnerability as patched; remediation is to update to the fixed release/version beyond 1.2.3.