21 matches found
CVE-2026-3253
The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...
EUVD-2026-85854
The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...
CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...
CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...
CVE-2026-3253: Missing Authorization
The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...
PT-2026-97785
Name of the Vulnerable Software and Affected Versions MailerLite – Signup forms official plugin for WordPress versions prior to 1.7.22 Description An issue exists where a missing capability check in the forms method of the AdminController class allows authenticated users with Contributor-level...
Grav: Stored XSS via quoted-attribute bypass in detectXss
Summary A page editor without admin.super can place an event handler after a inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it. Details Security::detectXss system/src/Grav/Common/Security.php:253 anchors the...
EUVD-2020-16460
Malware in sbrugna...
EUVD-2018-3061
Malware in sbrugna...
CVE-2025-6749
A vulnerability classified as critical was found in huija bicycleSharingServer up to 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a. Affected by this vulnerability is the function searchAdminMessageShow of the file AdminController.java. The manipulation of the argument Title leads to sql injection. The...
CVE-2025-6749
CVE-2025-6749 affects huija bicycleSharingServer, specifically the searchAdminMessageShow function in AdminController.java. The vulnerability arises from improper handling of the Title parameter, enabling SQL injection. Exploitation is network-based and can be attempted remotely; exploitation is ...
PT-2025-27047 · Unknown · Huija Bicyclesharingserver
Name of the Vulnerable Software and Affected Versions: huija bicycleSharingServer version 1.0 Description: A critical issue affects the selectAdminByNameLike function of the AdminController.java file, leading to SQL injection. The attack may be initiated remotely. The exploit has been disclosed t...
CVE-2024-13211 SingMR HouseRent AdminController.java access control
A vulnerability was found in SingMR HouseRent 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/main/java/com/house/wym/controller/AdminController.java. The manipulation leads to improper access controls. The attack may be launched remotely...
CVE-2024-36691
Insecure permissions in the AdminController.AjaxSave method of PPGoJobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account information...
CVE-2024-36691
Insecure permissions in the AdminController.AjaxSave method of PPGoJobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account information...
CVE-2024-36691
Insecure permissions in the AdminController.AjaxSave method of PPGoJobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account information...
CVE-2024-36691
The PPGo_Jobs task management system (version v2.8.0 ) is vulnerable to an insecure privilege issue within the AdminController.AjaxSave() method. This flaw allows authenticated attackers to arbitrarily modify users' account information. While technical details regarding specific remediation or pr...
CVE-2023-45958
Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the backuppagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload...
CVE-2022-38935
An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main/java/cn/niter/forum/controller/AdminController.java, allows attackers to gain escalated privileges...