33 matches found
CVE-2025-49173
CVE-2025-49173 — macOS 10.9 로컬 루트 권한 상승 연구 상태: 비공식 / 연구 기반 플랫폼: macOS Mavericks 10.9 영향: 로컬 권한 상승 → 루트 심각도: 높음 로컬 이 저장소는 macOS Mavericks 10.9에 영향을 미치는 로컬 루트 권한 상승 취약점 에 초점을 맞춘 개념 증명PoC 보안 연구 프로젝트 를 포함합니다. 여기에 사용된 CVE 식별자는 비공식이며 학술적 시연 목적으로만 사용됩니다. 개요 이 연구는 레거시 macOS 시스템의 특정 오구성 및 권한 부여 처리 조건에서 로컬...
CVE-2026-7891
The VerySecureApp made by DIVD using Mendix Studio Pro 11.8.0 Beta allows unintended data exposure due to authorization misconfiguration. The VerySecureApp allows anonymous users of the MyFirstModule with the anonymous user role to gain access to all stored records, even though no access rights a...
WordPress plugin Thim Core 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
WordPress plugin Smart Coupons for WooCommerce 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
WordPress plugin RSVP and Event Management 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, with the ability to host personal blog sites on PHP and MySQL based servers.WordPress...
WordPress plugin CF7 WOW Styler 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
Summary Budibase exposes a REST API for datasource management. The route PUT /api/datasources/:datasourceId is registered in the authorizedRoutes group with TABLE/READ permission. This is the same authorization level as the read endpoint GET /api/datasources/:datasourceId. Every authenticated...
EUVD-2026-28463
The VerySecureApp made by DIVD using Mendix Studio Pro 11.8.0 Beta allows unintended data exposure due to authorization misconfiguration. The VerySecureApp allows anonymous users of the MyFirstModule with the anonymous user role to gain access to all stored records, even though no access rights a...
CVE-2026-7891
Rejected reason: This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute...
CVE-2026-7891
...
CVE-2026-7891
The affected product is Siemens Mendix (Mendix Runtime, all versions; Mendix Studio Pro up to 11.8.0 Beta). The root cause is a documentation gap regarding the special behavior of the System.User entity with access rules, which may lead developers to unknowingly apply overly permissive rules, res...
CVE-2026-7891
A vulnerability has been identified in Mendix Runtime All versions. Mendix documentation for access rules does not adequately describe the special behavior of the System.User entity, leaving developers without sufficient guidance to configure access rules securely. This documentation gap may lead...
EUVD-2026-20205
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through = 20.8.10...
CVE-2026-1524 Auth misconfiguration when multiple providers enabled
An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures...
Siemens Mendix Application Authorization Misconfiguration Vulnerability
Siemens Mendix is a low-code application development platform from Siemens. An authorization misconfiguration vulnerability exists in the Siemens Mendix application, which can be exploited by an attacker to obtain sensitive information...
CVE-2026-24957 WordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through = 3.2.20...
Exploit for CVE-2025-49173
CVE-2025-49173 — macOS 10.9 Local Root Privilege Escalation R...
CVE-2025-67474 WordPress ForumWP plugin <= 2.1.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ultimate Member ForumWP forumwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ForumWP: from n/a through = 2.1.4...