PT-2025-1447 · Repute Infosystems · Armember Premium

Name of the Vulnerable Software and Affected Versions: Repute InfoSystems ARMember Premium versions prior to 5.9.2 Description: The issue is related to a missing authorization vulnerability in Repute InfoSystems ARMember Premium, which allows exploiting incorrectly configured access control...

CVE-2024-51667

Missing Authorization vulnerability in paytiumsupport Paytium paytium.This issue affects Paytium: from n/a through = 4.4.10...

CVE-2024-49686

CVE-2024-49686 relates to WordPress Landing Page Cat plugin, affected versions 1.7.4 and earlier. Patchstack details identify a Broken Access Control/Missing Authorization vulnerability (low severity, CVSS ~5.4) that could allow unauthorized actions. The fix is available in version 1.7.5; upgradi...

CVE-2024-56002 WordPress Contact Form, Survey & Form Builder – MightyForms plugin <= 1.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in mightyforms Contact Form, Survey & Form Builder – MightyForms mightyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form, Survey & Form Builder – MightyForms: from n/a through = 1.3.9...

CVE-2024-56002

CVE-2024-56002 corresponds to a Missing Authorization vulnerability in the WordPress plugin MightyForms (Contact Form, Survey & Form Builder). The entry states affected versions are up to 1.3.9 (from n/a through 1.3.9) and describes broken access control enabling unauthorized access. Public refer...

CVE-2024-56031 WordPress Smart Shopify Product plugin <= 1.0.2 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in Yulio Aleman Jimenez Smart Shopify Product smart-shopify-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Shopify Product: from n/a through = 1.0.2...

CVE-2024-56219

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.6.1...

CVE-2024-56217

Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through = 3.3.03...

CVE-2024-56234 WordPress VW Automobile Lite theme <= 2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Automobile Lite vw-automobile-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Automobile Lite: from n/a through = 2.1...

CVE-2024-56227 WordPress Royal Elementor Addons plugin <= 1.7.1001 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through = 1.7.1001...

CVE-2024-56225

Summary: CVE-2024-56225 affects the WordPress plugin “Premium Addons for Elementor” ( Leap13) prior to version 4.10.57. The root cause is a missing authorization check, allowing access to functionality not properly constrained by ACLs. What’s affected: Premium Addons for Elementor versions before...

CVE-2024-56211

CVE-2024-56211 affects the WordPress Plugin UserPro by DeluxeThemes (versions up to 5.1.9). The connected documents describe a Missing Authorization vulnerability that enables an authenticated user to perform an Arbitrary User Meta Update, due to insufficient authorization checks in UserPro. The ...

WordPress plugin WooCommerce Subscriptions 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin... WordPress plugin...

PT-2024-36673 · Yulio Aleman Jimenez · Smart Shopify Product

Name of the Vulnerable Software and Affected Versions: Yulio Aleman Jimenez Smart Shopify Product versions 1.0.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This vulnerabilit...

PT-2024-36760 · Leap13 · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor versions prior to 4.10.57 Description: The issue is related to a missing authorization vulnerability in the Leap13 Premium Addons for Elementor, which allows accessing functionality not properly constrained by...

TeamPass mail_me operation authorization issue

TeamPass before 3.1.3.1 does not properly check whether a mailme aka actionmail operation is on behalf of an administrator or manager...

GHSA-MPJ7-7MG7-X95J Apache NiFi: Missing Complete Authorization for Parameter and Service References

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

Sierra Wireless AirVantage 授权问题漏洞

Sierra Wireless AirVantage is an IoT connectivity and management platform from Sierra Wireless Canada. An authorization issue vulnerability exists in Sierra Wireless AirVantage. An attacker exploiting this vulnerability could configure, manage, and execute AT commands on a user's device...

CVE-2023-4617

Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in...

CVE-2023-4617 Gaining remote control over Govee devices

Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in...