Authorization

Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3...

Authorization

Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6...

Authorization

Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine Media Organizer & Lightroom.This issue affects Photo Engine Media Organizer & Lightroom: from n/a through 6.2.5...

CVE-2023-37871

CVE-2023-37871: The WooCommerce GoCardless Gateway plugin (

CVE-2023-38513

CVE-2023-38513 affects WordPress Photo Engine (Media Organizer & Lightroom) plugin, specifically Jordy Meow Photo Engine via the Photo Engine/WPLR‑Sync component. It is an Authorization Bypass through a User‑Controlled Key (IDOR) vulnerability that can bypass access controls. Affected range: n/a ...

CVE-2023-41796

The Sunshine Photo Cart plugin for WordPress (Sunshine Photo Cart: Free Client Galleries for Photographers) is affected by CVE-2023-41796. Affected versions are before 3.0.0 and the root cause is Insecure Direct Object References (IDOR) caused by authorization bypass via a user-controlled key, en...

CVE-2023-46311 WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3...

CVE-2023-46311

CVE-2023-46311 refers to the WordPress plugin wpDiscuz (Comments)

Path Traversal

org.apache.tiles: tiles-core is vulnerable to Path Traversal. The vulnerability is due to missing validation in the DefaultLocaleResolver.LOCALEKEY attribute set on the session while resolving XML definition files. This can lead to Server Side Request Forgery SSRF or XML External Entity Injection...

PT-2023-25607 · Unknown · Marketingfire Editorial Calendar

Name of the Vulnerable Software and Affected Versions: MarketingFire Editorial Calendar versions 3.7.12 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar. Recommendations: For versions 3.7.12 and...

PT-2023-25379 · Woocommerce · Woocommerce Subscriptions

Name of the Vulnerable Software and Affected Versions: WooCommerce Woo Subscriptions versions prior to 5.1.3 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability affects WooCommerce Woo Subscriptions, allowing unauthorized...

PT-2023-25355 · Unknown · Woocommerce Square

Name of the Vulnerable Software and Affected Versions: WooCommerce Square versions 3.8.1 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This allows for potential unauthorized access. Recommendations: For versions 3.8.1 and...

CVE-2023-6929 Authorization Bypass Through User-Controlled Key in EuroTel ETL3100

EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers can bypass authorization, access the hidden resources on the...

CVE-2022-43450

Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2...

CVE-2022-43450

Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2...

CVE-2023-49812

Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005...

Authorization

Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005...

CVE-2023-49812

CVE-2023-49812 affects WP Photo Album Plus plugins (WordPress) up to version 8.5.02.005 and is an Insecure Direct Object Reference (IDOR) vulnerability caused by missing validation on a user-controlled key. It allows unauthenticated access to unauthorized actions, as detailed by Patchstack/NVD/NV...

PT-2023-31367 · WordPress · Wp Photo Album Plus

Name of the Vulnerable Software and Affected Versions: WP Photo Album Plus versions through 8.5.02.005 Description: The issue is related to an Authorization Bypass Through User-Controlled Key. This allows for unauthorized access. Recommendations: For WP Photo Album Plus versions through 8.5.02.00...

WordPress Plugin Stream Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...