10 matches found
CVE-2026-86707
The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...
CVE-2026-86710 Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...
CVE-2026-65888 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...
CVE-2025-15016 Ragic｜Enterprise Cloud Database - Hard-coded Cryptographic Key
Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information and log into the system as any user...
WordPress Plugin BookIt: Access control error vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
SUSE CVE-2023-3326
pamkrb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket tgt from the Kerberos KDC Key Distribution Center over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pamkrb5 has no way to validate...
CVE-2021-39070
IBM Security Verify Access 10.0.0.0, 10.0.1.0 and 10.0.2.0 with the advanced access control authentication service enabled could allow an attacker to authenticate as any user on the system. IBM X-Force ID: 215353...
CVE-2020-2299: Undefined Security Weakness
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password...
Ltd. happy city localized e-commerce APP has logic flaws vulnerability
Happy Merchant App is a store management software that serves merchant users. There is a logic flaw vulnerability in the Happy City localized e-commerce APP of Jiangsu Patrol Network Technology Co. Attackers can utilize the vulnerability to log in to the system with any user including the merchan...
