CVE-2021-24639

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgfajaxemptydir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server...

CVE-2021-24688

The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the ordeletefiled one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing...

CVE-2021-25025

The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the addcalendarevent AJAX actions, allowing users with a role as low as subscriber to create events...

CVE-2021-24947

The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvmuploadregionsfilepath parameter in the rvmimportregions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server...

CVE-2021-24819

The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including posts created by other users such as...

CVE-2025-48257 WordPress Projectopia plugin <= 5.1.17 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Projectopia Projectopia projectopia-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Projectopia: from n/a through = 5.1.17...

CVE-2025-48247 WordPress Shortlinks by Pretty Links <= 3.6.15 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Blair Williams Shortlinks by Pretty Links allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shortlinks by Pretty Links: from n/a through 3.6.15...

NATS-Server Fails to Authorize Certain Jetstream Admin APIs

...

CVE-2025-24577

The CVE-2025-24577 entry concerns the WordPress Poll Maker plugin (versions through 5.5.0) with a Missing Authorization vulnerability that leads to Broken Access Control. Affected component is the plugin’s access control logic; root cause described as misconfigured access control/security levels....

CVE-2024-12048

CVE-2024-12048 describes an IDOR (Insecure Direct Object Reference) in transformeroptimus/superagi v0.0.14. The vulnerability arises from improper authorization checks across multiple API endpoints, allowing an attacker to view, edit, and delete other users’ information without proper authorizati...

CVE-2024-9159

CVE-2024-9159 affects gaizhenbiao/chuanhuchatgpt (git commit c91dbfc). The reboot/server restart function is not protected by an admin check, enabling an attacker to trigger a server restart and cause availability loss. Underlying root cause: improper authorization check around the restart operat...

Mattermost Fails to Properly Perform Viewer Role Authorization

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

CVE-2023-50946

IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism...

Mattermost Incorrect Authorization vulnerability

Mattermost versions 9.11.x = 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allowopeninvite" field via making their team public...

CVE-2024-12158

CVE-2024-12158 concerns the Popup – MailChimp, GetResponse and ActiveCampaign Integrations WordPress plugin. The vulnerability is a missing capability check on the AJAX action upc_delete_db_data, affecting all versions up to and including 3.2.6. This permits unauthenticated attackers to delete th...

CVE-2024-12210

CVE-2024-12210 affects the Print Invoice & Delivery Notes for WooCommerce WordPress plugin. It allows authenticated users with Subscriber+ privileges to remove the shop logo due to a missing capability check on the wcdn_remove_shoplogo AJAX action, impacting all versions up to and including 5.4.0...

CVE-2023-48750 WordPress Void Elementor Post Grid Addon for Elementor Page builder plugin <= 2.1.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in voidthemes Void Elementor Post Grid Addon for Elementor Page builder void-elementor-post-grid-addon-for-elementor-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Void Elementor Post Grid Addon for...

WordPress plugin Essential Blocks for Gutenberg 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2024-9082

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The manipulation of the argument Type with the input 1 leads to...

eLinkSmart Hidden Smart Cabinet Lock Security Vulnerability

eLinkSmart Hidden Smart Cabinet Lock is a hidden smart cabinet lock from China eLinkSmart. A security vulnerability exists in eLinkSmart Hidden Smart Cabinet Lock version 2024-05-22, which stems from the presence of an access control error and authorization check failure...