7 matches found
CVE-2026-9709 Themeco Cornerstone < 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta Disclosure
The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co...
EUVD-2018-2663
Malware in sbrugna...
CVE-2025-54397
Netwrix Directory Manager (formerly Imanami GroupID) versions 11.0.0.0 through 11.1.25161.02 are vulnerable to a flaw where the software inserts sensitive information into sent data provided to authenticated users. The root cause is attributed to improper access control (CWE-284). To remediate th...
CVE-2017-15196
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user...
CVE-2025-3851
CVE-2025-3851 affects the WordPress plug‑in WP SmartPay (Download Manager and Payment Form) . The issue is an Insecure Direct Object Reference in the show() function caused by missing validation on a user‑controlled key, which could allow an authenticated attacker with Subscriber+ privileges to v...
