31574 matches found
CVE-2025-13540
The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiaremembershipinitrestapiregister' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attacker...
CVE-2025-13540
CVE-2025-13540 affects the Tiare Membership WordPress plugin (versions
CVE-2025-13540 Tiare Membership <= 1.2 - Unauthenticated Privilege Escalation
The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiaremembershipinitrestapiregister' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attacker...
CVE-2025-13540 Tiare Membership <= 1.2 - Unauthenticated Privilege Escalation
The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiaremembershipinitrestapiregister' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attacker...
CVE-2025-13680 Tiger <= 101.2.1 - Authenticated (Subscriber+) Privilege Escalation
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user-setrole function. This makes it possible for authenticated attackers, with Subscriber-level access...
CVE-2025-13675 Tiger <= 101.2.1 - Unauthenticated Privilege Escalation
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrato...
CVE-2025-13680 Tiger <= 101.2.1 - Authenticated (Subscriber+) Privilege Escalation
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user-setrole function. This makes it possible for authenticated attackers, with Subscriber-level access...
CVE-2025-13675 Tiger <= 101.2.1 - Unauthenticated Privilege Escalation
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrato...
CVE-2025-13675
CVE-2025-13675 affects the Tiger WordPress Theme (pre-101.2.2; WordPress Tiger 101.2.1 and earlier). The root cause is in paypal-submit.php, which does not restrict registration roles, allowing unauthenticated attackers to set administrator during signup. Impact is unauthenticated privilege escal...
CVE-2025-13680
CVE-2025-13680 affects the WordPress Tiger theme (versions up to and including 101.2.1). The vulnerability is an Authenticated Privilege Escalation where an attacker with Subscriber-level access or higher can exploit the plugin to elevate privileges via the $user->set_role() function, potentia...
CVE-2025-13538 FindAll Listing <= 1.0.5 - Unauthenticated Privilege Escalation
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findalllistinguserregistrationadditionalparams' function not restricting what user roles a user can register with. This makes it possible for...
CVE-2025-13538 FindAll Listing <= 1.0.5 - Unauthenticated Privilege Escalation
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findalllistinguserregistrationadditionalparams' function not restricting what user roles a user can register with. This makes it possible for...
PT-2025-48227
Name of the Vulnerable Software and Affected Versions FindAll Listing versions prior to 1.0.6 Description The FindAll Listing plugin for WordPress is susceptible to a privilege escalation issue. This occurs because the findall listing user registration additional params function does not properly...
PT-2025-48230
Name of the Vulnerable Software and Affected Versions Tiger theme for WordPress versions prior to 101.2.2 Description The Tiger theme for WordPress is susceptible to a privilege escalation issue. The paypal-submit.php file does not properly restrict user roles during registration. This allows...
PT-2025-48229
The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiare membership init rest api register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated...
Blog Site admin.php file improper authorization vulnerability
Blog Site is a blogging system. Blog Site suffers from an improper authorization vulnerability that originates in the file /admin.php, which can be exploited by an attacker to compromise confidentiality, integrity, and availability...
EUVD-2025-199739
Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend...
CVE-2025-55469
Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend...
CVE-2025-20373 Sensitive Information Disclosure in “_internal“ index through Splunk Add-On for Palo Alto Networks
In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the internal index during the addition of new “Data Security Accounts“. The vulnerability would require either local access to the log files or administrative access to internal indexe...
CVE-2025-12032
The Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vithanhlamzsocialsavemessager’, 'vithanhlamzsocialsavezalo', 'vithanhlamzsocialsavehotline', and 'vithanhlamzsocialsavecontact' parameters in all versions up to, and...