CVE-2025-22963: Cross-Site Request Forgery (CSRF)

Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin...

CVE-2024-36467

An authenticated user with API access e.g.: user with default User role, more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group e.g.: Zabbix Administrators, except to groups that are disabled or having restricted GUI access...

Debian dla-3953 : icinga2 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3953 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3953-1 [email protected]...

PT-2024-8523

Name of the Vulnerable Software and Affected Versions Icinga 2 versions 2.4.0 through 2.11.12 Icinga 2 versions 2.12.0 through 2.12.11 Icinga 2 versions 2.13.0 through 2.13.10 Icinga 2 versions 2.14.0 through 2.14.3 Description Icinga is a monitoring system used to check network resource...

CVE-2024-40539

my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/user...

CVE-2024-40539: Improper Neutralization of Special Elements used in an SQL Command

my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/user...

CVE-2024-6624

The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin require...

CVE-2024-6624 JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation

The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin require...

CVE-2024-6624 JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation

The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin require...

CVE-2024-6624

CVE-2024-6624 affects JSON API User (WordPress) up to v3.9.3, enabling unauthenticated privilege escalation due to improper handling of custom user meta. Exploit activity exists: GitHub exploits show unauthenticated admin registration; Wordfence notes the entry is patched. Affected plugin require...

CVE-2024-6676

A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched...

CVE-2024-6676

A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched...

WordPress plugin JSON API User security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-6676: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched...

CVE-2024-6624: Improper Privilege Management

The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin require...

PT-2024-37753 · WordPress · Json Api User +1

Name of the Vulnerable Software and Affected Versions: JSON API User plugin for WordPress versions up to, and including, 3.9.3 Description: The issue is due to improper controls on custom user meta fields, making it possible for unauthenticated attackers to register as administrators on the site...

WordPress JSON API User plugin <= 3.9.3 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Thanh Nam Tran in WordPress Plugin JSON API User versions = 3.9.3...

WordPress JSON API User Plugin <= 3.9.3 is vulnerable to Privilege Escalation

Software JSON API User Type Plugin Vulnerable versions = 3.9.3 Fixed in 3.9.4 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-6624 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID c77720f52f77 Credits Thanh Nam Tran Required privile...

CVE-2024-28270

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...

CVE-2023-6792: Improper Neutralization of Argument Delimiters in a Command

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...