CVE-2025-57909 WordPress Editor Custom Color Palette plugin <= 3.5.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rouergue Création Editor Custom Color Palette editor-custom-color-palette allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editor Custom Color Palette: from n/a through = 3.5.6...

CVE-2025-58672

CVE-2025-58672 is a Missing Authorization vulnerability in WP User Frontend. The connected Wordfence entry confirms an Authenticated (Subscriber+) Arbitrary Shortcode Execution in WP User Frontend

PT-2025-38989

Name of the Vulnerable Software and Affected Versions Barry Event Rocket versions through 3.3 Description An authorization issue exists in Barry Event Rocket, allowing exploitation due to incorrectly configured access control security levels. Recommendations At the moment, there is no information...

PT-2025-38826

Name of the Vulnerable Software and Affected Versions CardCom Payment Gateway versions through 3.5.0.4 Description An authorization issue exists in CardCom Payment Gateway due to incorrectly configured access control security levels. This allows for potential exploitation. Recommendations Update ...

PT-2025-39017

Name of the Vulnerable Software and Affected Versions Heureka versions through 1.1.0 Description A missing authorization flaw exists in Heureka. This issue allows access to functionality that is not properly restricted by Access Control Lists ACLs. Recommendations Update to a version later than...

PT-2025-38789

Name of the Vulnerable Software and Affected Versions Blocksera Image Hover Effects – Elementor Addon versions through 1.4.4 Description The software contains a missing authorization issue related to incorrectly configured access control security levels. Recommendations At the moment, there is no...

PT-2025-38968

Name of the Vulnerable Software and Affected Versions Gutentor versions through 3.5.2 Description An authorization issue exists in Gutentor, allowing exploitation of incorrectly configured access control security levels. Recommendations Update Gutentor to a version later than 3.5.2...

PT-2025-38967

Name of the Vulnerable Software and Affected Versions AppMySite versions through 3.14.0 Description An authorization issue exists in AppMySite, allowing exploitation of incorrectly configured access control security levels. Recommendations Update AppMySite to a version later than 3.14.0...

WordPress plugin Accordion 安全漏洞

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A lack of authorization vulnerability exists in the WordPress plugin Accordion, which can be...

WordPress plugin CP Multi View Event Calendar 安全漏洞

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An authorization missing vulnerability exists in the WordPress plugin CP Multi View Event...

PT-2025-38850

Name of the Vulnerable Software and Affected Versions Memberful versions through 1.75.0 Description A missing authorization issue exists in Memberful, allowing access to functionality that is not properly constrained by Access Control Lists ACLs. Recommendations Update to a version later than...

Weitong Mall 授权问题漏洞

Weitong Mall Weitong Mall is a shopping mall system by fuyanglipengjun, an individual developer. Weitong Mall version 1.0 has an authorization issue vulnerability, the vulnerability stems from improper authorization of the function AttributeCategoryController in the file...

Weitong Mall 授权问题漏洞

Weitong Mall Weitong Mall is a shopping mall system by fuyanglipengjun, an individual developer. An authorization issue vulnerability exists in Weitong Mall version 1.0, which originates from improper authorization of the BrandController function in the file /brand/queryAll, and could lead to a...

Mattermost Missing Authorization vulnerability

Mattermost versions 10.10.x = 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instanc...

CRMEB 授权问题漏洞

CRMEB is a Java mall system of CRMEB open source. An authorization issue vulnerability exists in CRMEB 5.6.1 and earlier versions, which stems from incorrect manipulation of the parameter ID of the component Administrator Password Handler in the file...

CRMEB 授权问题漏洞

CRMEB is a Java mall system of CRMEB open source. An authorization issue vulnerability exists in CRMEB 5.6.1 and earlier versions, which stems from improper manipulation of the parameter ID of the function editAddress in the file app/services/user/UserAddressServices.php, which could lead to...

RuoYi 授权问题漏洞

RuoYi is a backend management system for individual developers in China RuoYi RuoYi. RuoYi 4.8.1 and previous versions of the authorization problem vulnerability, the vulnerability stems from the file / system / role / authUser / cancelAll in the parameter roleId and userIds there is improper...

litemall 授权问题漏洞

litemall is a small mall system for linlinjava individual developers. An authorization issue vulnerability exists in litemall 1.8.0 and earlier versions, which stems from incorrect manipulation of the parameter ID of the function WxAftersaleController in the file /wx/aftersale/cancel, which could...

WordPress Maspik plugin authorization issue vulnerability

WordPress Maspik plugin is an anti-spam plugin for WordPress that is mainly used to protect website contact forms, comment areas and signup forms from spam. WordPress Maspik plugin suffers from an authorization issue vulnerability that stems from a lack of capability check in the function...

yudao-cloud 授权问题漏洞

yudao-cloud is a backend management system for YunaiV individual developers. An authorization issue vulnerability exists in yudao-cloud version 2025.09 and earlier, which stems from incorrect manipulation of the parameter ID in the file /crm/receivable/submit, which could lead to improper...