CVE-2022-0345

The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfwsearchusers AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes finding the first letter, then the second one, then the third one...

CVE-2022-26102

Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start screen of any transaction that is available with in the same SAP system even if he/she isn't authorized for that transactio...

CVE-2024-41728

Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects...

CVE-2021-27605

SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last...

CVE-2022-31168

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

Summary The ImportIam admin API validates permissions using ExportIAMAction instead of ImportIAMAction, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions creating/updating users, groups, policies, and...

EUVD-2026-1424

Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. The vulnerable code path...

CVE-2025-5919

CVE-2025-5919 affects the WordPress plugin “Appointment Booking Calendar – WP Timetics Booking Plugin.” The vulnerability stems from a missing capability check in the update and register_routes functions across versions up to 1.0.36, allowing unauthenticated attackers to view and modify booking d...

CVE-2025-14034

The vulnerability CVE-2025-14034 affects the ilGhera Support System for WooCommerce WordPress plugin. A missing capability check in delete_single_ticket_callback and change_ticket_status_callback in all versions through 1.2.6 allows authenticated attackers with Subscriber+ privileges to delete ar...

OpenCTI 安全漏洞

OpenCTI is an open source cyber threat intelligence platform from OpenCTI Open Source. A security vulnerability exists in OpenCTI versions prior to 6.8.1, which stems from a lack of authorization checking in a GraphQL mutation that could lead to unauthorized resource deletion...

CVE-2025-14428

CVE-2025-14428 affects the WordPress plugin “All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements” up to version 2.3.3. The issue is a missing capability check in the my_sticky_elements_bulks function, allowing authenticated attackers with Su...

PT-2025-53903

Name of the Vulnerable Software and Affected Versions HR Management Lite versions prior to 3.6 Description An incorrect access control configuration exists in Weblizar HR Management Lite, potentially allowing unauthorized access. The issue involves a missing authorization check. Recommendations...

WordPress plugin Frontend Post Submission Manager Lite – Frontend Posting 安全漏洞

...

PT-2025-53282

Name of the Vulnerable Software and Affected Versions Assaf Parag Poll, Survey & Quiz Maker Plugin by Opinion Stage versions through 19.12.1 Description The Assaf Parag Poll, Survey & Quiz Maker Plugin by Opinion Stage has an issue related to incorrectly configured access control security levels,...

EUVD-2025-204634

The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authenticated users to update them...

PT-2025-52546

Name of the Vulnerable Software and Affected Versions Pure WC Variation Swatches WordPress plugin versions through 1.1.7 Description The Pure WC Variation Swatches WordPress plugin does not perform authorization checks when updating its settings. This allows any authenticated user to modify these...

WordPress plugin Pure WC Variation Swatches 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-11369

Technical details for CVE-2025-11369 (Gutenberg Essential Blocks) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2025-13741

The CVE-2025-13741 entry concerns the Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin. It states a missing capability check in getAuthors across all versions up to 4.9.2, allowing authenticated attackers with Contributor-...

CVE-2025-13403

The Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to unauthorized tracking settings modification due to missing authorization validation on the employeespotlightcheckoptin function in all versions up to, and including, 5.1.3. This makes it possible f...