18658 matches found
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the routeName query parameter in the custom-action dispatch process. An attacker can gain unauthorized access to restricted backend routes by specifying the name of a protected route, thereby bypassing...
CVE-2025-15489 Passster < 4.2.24 - Password Protection Bypass
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...
CVE-2025-15489
The Passster WordPress plugin before version 4.2.24 contains an improper input handling flaw in an AJAX action , allowing unauthenticated users to retrieve the value of password-protected content. This constitutes a password protection bypass , with a CVSS 3.1 score of 5.3 (Medium) reflecting net...
EUVD-2025-210831
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...
CVE-2026-84800
Craft CMS versions = 5.0.0-RC1 and 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so...
CVE-2026-84800
Craft CMS versions >= 5.0.0-RC1 and
CVE-2026-16966
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...
CVE-2026-81426
The WC Vendors WordPress plugin, in versions prior to 2.7.2.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF protection on specific front-end order shipment status actions. This flaw could allow an attacker to force a logged-in vendor to modify the...
CVE-2026-14215 Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...
EUVD-2026-69869
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...
CVE-2026-14215 Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...
CVE-2026-16966 Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...
WordPress Booking for Appointments and Events Calendar plugin < 2.4.9 - Unauthenticated Post-Booking Action Trigger vulnerability
Unauthenticated Post-Booking Action Trigger vulnerability discovered by Haitam Lazaar in WordPress Plugin Amelia versions 2.4.9...
The vulnerability of the Easy Hosting Control Panel (EHCP) related to the lack of security measures for the website structure allows attackers to execute arbitrary code.
The vulnerability of the Easy Hosting Control Panel EHCP relates to the lack of measures taken to protect the structure of the web page when processing the “action” parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
PT-2026-84884
A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possibl...
PT-2026-84673
Craft CMS versions = 5.0.0-RC1 and 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so...
CVE-2026-12526: Improper Authentication
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...
CVE-2025-15489: Incorrect Authorization
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...
CVE-2026-16966: Exposure of Sensitive Information to an Unauthorized Actor
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...
CVE-2026-14215: Missing Authorization
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...