CVE-2025-32281 WordPress DarkMySite plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in DarkMySite DarkMySite darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite: from n/a through = 1.2.8...

CVE-2025-52817

The CVE refers to the WordPress plugin Abandoned Contact Form 7 (versions n/a through 2.0) with a Missing Authorization / Broken Access Control vulnerability. Affected component is the plugin’s access control configuration, enabling exploitation due to incorrectly configured access levels. CVSS/m...

CVE-2025-52818 WordPress Trusty Whistleblowing plugin <= 1.5.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Dejan Jasnic Trusty Whistleblowing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Trusty Whistleblowing: from n/a through 1.5.2...

PT-2025-27135 · Zealousweb · Zealousweb Abandoned Contact Form 7

Name of the Vulnerable Software and Affected Versions: ZealousWeb Abandoned Contact Form 7 versions n/a through 2.0 Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations:...

PT-2025-27137 · Unknown · Mdjm Mobile Dj Manager

Name of the Vulnerable Software and Affected Versions: MDJM Mobile DJ Manager versions 1.7.6 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For MDJM Mobile...

PT-2025-27215 · WordPress · Wp Db Booster

Name of the Vulnerable Software and Affected Versions: WP DB Booster versions 1.0.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For WP DB Booster versions...

CVE-2025-5812 VG WORT METIS <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update

The VG WORT METIS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gutenbergsavepost function in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-49549

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain limited...

CVE-2025-5822

Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation is confirmed for CVE-2025-5822. The flaw exists in the Autel Technician API implementation and results from incorrect authorization, allowing an attacker who has obtained a low-privilege authorizat...

Adobe Commerce 安全漏洞

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. An incorrect authorization vulnerability exists in Adobe Commerce, which could be exploited by an attacker to cause a security feature bypass...

Adobe Commerce 安全漏洞

Adobe Commerce is the United States of America Odobie Adobe company's a kind of merchants and brands for the world's leading digital commerce solutions. An incorrect authorization vulnerability exists in Adobe Commerce, which could be exploited by an attacker to cause a security feature bypass...

Control iD iDSecure On-premises 授权问题漏洞

Control iD iDSecure On-premises is an access control software from Control iD, a Brazilian company, used to manage personnel and vehicle access. An authorization issue vulnerability exists in Control iD iDSecure On-premises version 4.7.48.0 and prior versions, which stems from improper...

Hikka 授权问题漏洞

Hikka is a developer-oriented Telegram user bot by Daniil Gazizullin Personal Developer. An authorization issue vulnerability exists in Hikka versions prior to 1.6.2, which stems from an unauthenticated attacker being able to gain full access to a victim's Telegram account and server...

CVE-2024-3511

An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versione...

CVE-2024-3511 Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files

An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versione...

Xiaomi Mi Connect Service APP 授权问题漏洞

Xiaomi Mi Connect Service APP is an application from China's Xiaomi Xiaomi that is used to enable connectivity and interaction between Xiaomi devices, which helps users to quickly connect and manage a variety of Xiaomi smart devices to enable data transfer and collaborative work between devices. ...

Allegra 授权问题漏洞

Allegra is a project management software for mid-sized organizations from Allegra. An authorization issue vulnerability exists in Allegra that stems from a password recovery mechanism that relies on predictable values, which could lead to authentication bypass...

CVE-2025-49973

Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Sizes Controller, Create Custom Image Sizes, Disable...

CVE-2025-49974

Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through = 2.1.1...

CVE-2025-49969 WordPress Zara 4 Image Compression plugin <= 1.2.17.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Zara 4 Zara 4 Image Compression zara-4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zara 4 Image Compression: from n/a through = 1.2.17.2...