CVE-2025-59827 FlagForgeCTF is Missing Authorization in main-v2

Flag Forge is a Capture The Flag CTF platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges e.g., Staff to themselves. This could lead to privilege escalation and impersonation of administrative...

CVE-2025-58681

Missing Authorization vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Quotes: from n/a through = 1.2.4...

CVE-2025-57969

Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar hide-wp-toolbar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide WP Toolbar: from n/a through = 2.7...

AutomationDirect CLICK PLUS 安全漏洞

The AutomationDirect CLICK PLUS is a small programmable logic controller from AutomationDirect, Inc. A security vulnerability exists in AutomationDirect CLICK PLUS version 3.60, which stems from improper authorization of the KOPR protocol, and could result in a low-privileged user overstepping...

CVE-2025-10819 fuyang_lipengjun platform queryAll UserCouponController improper authorization

A security vulnerability has been detected in fuyanglipengjun platform 1.0. This issue affects the function UserCouponController of the file /usercoupon/queryAll. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed public...

CVE-2025-58009 WordPress CP Multi View Event Calendar plugin <= 1.4.35 - Broken Access Control vulnerability

Missing Authorization vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through = 1.4.35...

CVE-2025-58663

CVE-2025-58663 (Qubely – WordPress) details: Affected software: Qubely (Advanced Gutenberg Blocks) up to version 1.8.14. Root cause: Missing Authorization due to incorrectly configured access control security levels. Consequence: The vulnerability is described as a Missing Authorization issue tha...

CVE-2025-57605

Lack of server-side authorisation on department admin assignment APIs in AiKaan IoT Platform allows authenticated users to elevate their privileges by assigning themselves as admins of other departments. This results in unauthorized privilege escalation across the department...

Weitong Mall 授权问题漏洞

Weitong Mall is a shopping mall system developed by fuyanglipengjun. Weitong Mall version 1.0 has an authorization issue vulnerability, the vulnerability stems from improper authorization of the TopicCategoryController function in the file /topiccategory/queryAll, which may lead to remote attacks...

WordPress plugin Memberful 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

WordPress plugin Image Hover Effects – Elementor Addon 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blogging sites on PHP and MySQL based servers.WordPress plugin is an application plugin... A security...

WordPress plugin MasterStudy LMS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

WordPress plugin Hide WP Toolbar 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

WordPress plugin Gutentor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

PT-2025-38914

Name of the Vulnerable Software and Affected Versions POSIMYTH Sticky Header Effects for Elementor versions through 2.1.2 Description An authorization issue exists in POSIMYTH Sticky Header Effects for Elementor, allowing exploitation of incorrectly configured access control security levels...

Weitong Mall 授权问题漏洞

Weitong Mall is a shopping mall system developed by fuyanglipengjun. Weitong Mall Weitong Mall 1.0 version of the authorization problem vulnerability, the vulnerability stems from the file /usercoupon/queryAll function UserCouponController authorization is not appropriate, which may lead to remot...

CVE-2025-10675

A security flaw has been discovered in fuyanglipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public...

CVE-2025-10676

The CVE-2025-10676 entry concerns the fuyang_lipengjun platform 1.0, specifically the BrandController function in /brand/queryAll. The connected documents describe an improper authorization vulnerability that can be exploited remotely, with publicly available exploit code. The issue affects the B...

Weitong Mall 授权问题漏洞

Weitong Mall Weitong Mall is a shopping mall system by fuyanglipengjun individual developer. An authorization issue vulnerability exists in Weitong Mall version 1.0, which stems from improper authorization of the AttributeController function in file/attribute/queryAll, and could lead to remote...

Incorrect Authorization

Overview org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities. Affected versions of this package are vulnerable to Incorrect Authorization via the AnnotationsScanner and AnnotatedMethod class. An attacker can gain unauthorized...