CVE-2025-0355

CVE-2025-0355 concerns NEC Aterm devices with a Missing Authentication for Critical Function, allowing an unauthenticated attacker to obtain Wi‑Fi passwords over the network. Affected products and vulnerable versions (from connected JVN entries): WG2600HS (prior to 1.7.2), WF1200CRS (prior to 1.6...

CVE-2024-36510

CVE-2024-36510 affects Fortinet FortiClientEMS and FortiSOAR. The issue is an observable response discrepancy (CWE-204) that could allow an unauthenticated attacker to enumerate valid users by observing login request responses. Affected: FortiClientEMS versions 7.0 all versions and 7.2.0–7.2.4, 7...

CVE-2025-0070

CVE-2025-0070 affects SAP NetWeaver Application Server for ABAP and ABAP Platform. Affected component: authentication checks in the ABAP server allowing an authenticated attacker to escalate privileges and gain illegitimate access. Documented impact: high on confidentiality, integrity, and availa...

CVE-2023-42241

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vamanagraphic.php...

CVE-2024-54762

Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. This is because the filterKeyword method does not completely filter SQL injection keywords, resulting in the risk of SQL injection...

CVE-2024-13258

Summary: CVE-2024-13258 is an Incorrect Authorization issue in the Drupal REST & JSON API Authentication module that allows forceful browsing. Affected software: Drupal REST & JSON API Authentication module (versions 0.0.0 through 2.0.12). Root cause/impact: Insufficient access control could bypa...

CVE-2024-6155

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated Subscriber+ Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshiftdownloadfilelocaly function...

CVE-2024-6155 Greenshift – animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated Subscriber+ Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshiftdownloadfilelocaly function...

CVE-2024-12264

The PayU CommercePro Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.8.3. This is due to /wp-json/payu/v1/generate-user-token and /wp-json/payu/v1/get-shipping-cost REST API endpoints not properly verifying a user's identity prior to setti...

CVE-2024-10527

CVE-2024-10527 affects the Spacer WordPress plugin. The vulnerability results from a missing capability check in the motech_spacer_callback() function across all versions up to and including 3.0.7. This allows authenticated users with Subscriber-level access and above to view limited settings inf...

NiceGUI On Air authentication issue

Summary Once a user logins to one browser, all other browsers are logged in without entering password. Even incognito mode. Impact high...

CVE-2025-21618 NiceGUI On Air authentication issue

NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1...

CVE-2025-21618

CVE-2025-21618 (NiceGUI) affects NiceGUI (Python UI framework) prior to version 2.9.1. The root cause is improper handling of authentication cookies/session state, causing a login in one browser (including incognito) to persist across all other browsers on the same user account. Impact is unautho...

CVE-2025-21618 NiceGUI On Air authentication issue

NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1...

CVE-2024-55538

Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image macOS before build 41725, Acronis True Image Windows before build 41736, Acronis True Image OEM macOS before build 42571, Acronis True Image OEM Windows before build 42575...

CVE-2022-45830 WordPress Analytify - Google Analytics Dashboard plugin <= 4.2.3 - Privilege Escalation vulnerability

Missing Authorization vulnerability in Analytify.This issue affects Analytify: from n/a through 4.2.3...

CVE-2024-55538

Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image macOS before build 41725, Acronis True Image Windows before build 41736, Acronis True Image OEM macOS before build 42571, Acronis True Image OEM Windows before build 42575...

WordPress plugin WP Travel 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Fedora: Security Advisory (FEDORA-2024-0fa283c43a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress plugin Appointment Hour Booking 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...