CVE-2024-22316

IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to perform unauthorized actions to another user's data due to improper access controls...

Advisory ROSA-SA-2025-2577

Software: wpasupplicant 2.11 WASP: ROSA-CHROME packageevrstring: wpasupplicant-2.11-3 CVE-ID: CVE-2023-52160 BDU-ID: 2024-01426 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Protected Extensible Authentication Protocol PEAP implementation of the Wi-Fi WPA Supplicant secure access client is...

PT-2025-4923 · Unknown · Blokhaus Minterpress

Name of the Vulnerable Software and Affected Versions: Blokhaus Minterpress versions n/a through 1.0.5 Description: The issue is related to a lack of authorization in Blokhaus Minterpress, allowing access to functions that are not properly constrained by access control lists ACLs. Recommendations...

PT-2025-5558 · Houzez · Houzez

Name of the Vulnerable Software and Affected Versions: Houzez versions prior to 3.4.0 Description: The issue is related to a lack of authorization in Houzez. This problem affects Houzez, with details about the estimated number of potentially affected devices worldwide not provided. Information...

PT-2025-5442 · Sprout Invoices · Client Invoicing

Name of the Vulnerable Software and Affected Versions: Client Invoicing by Sprout Invoices versions prior to 20.8.1 Description: The issue is related to a lack of authorization in Client Invoicing by Sprout Invoices, allowing the exploitation of incorrectly configured access control security...

PT-2025-5436 · Rsvpmaker · Rsvpmaker

Name of the Vulnerable Software and Affected Versions: RSVPMarker versions prior to 11.4.5 Description: The issue is related to a lack of authorization in RSVPMarker. This problem affects RSVPMarker from an unspecified starting version up to version 11.4.5. Recommendations: For versions prior to...

CVE-2025-24753

Missing Authorization vulnerability in Kadence WP Gutenberg Blocks by Kadence Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.3.1...

CVE-2025-22607 Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the details page for any GitHub / GitLab configuration on a Coolify instance by only knowing the UU...

PT-2025-5432 · WordPress · Woocommerce Product Table Lite

Name of the Vulnerable Software and Affected Versions: WooCommerce Product Table Lite versions 3.8.7 and earlier Description: The issue is related to a lack of authorization in WooCommerce Product Table Lite, allowing the exploitation of incorrectly configured access control security levels...

WordPress plugin People Lists 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-20156

A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This vulnerability exists because proper authorization is not enforced upon REST API users. An attacker could...

PT-2025-4286 · Oracle · Oracle Agile Plm Framework

Name of the Vulnerable Software and Affected Versions: Oracle Agile PLM Framework version 9.3.6 Description: The vulnerability in the Oracle Agile PLM Framework is related to weaknesses in the authorization mechanism of the Install component. This issue can be exploited by a remote attacker to...

PT-2025-3971 · Opencart +1 · Opencart +1

The Shiprocket Module 3 on OpenCart is affected by a critical issue, where the manipulation of the contentHash argument in the REST API Module leads to incorrect authorization 🚨. This allows for remote attacks, although the complexity is rather high and exploitation is known to be difficult. The...

PT-2025-5313

Name of the Vulnerable Software and Affected Versions Safari versions prior to 18.3 macOS Sequoia versions prior to 15.3 iOS versions prior to 18.3 iPadOS versions prior to 18.3 visionOS versions prior to 2.3 Description The issue is related to a lack of authorization procedure in the WebKit...

CVE-2024-50633

A Broken Object Level Authorization BOLA vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain...

Matrix 授权问题漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. Matrix suffers from an authorization issue vulnerability that stems from allowing a remote participant to trigger the download and caching of remote media from a remote home server to a local media repository...

PT-2025-5084 · Unknown · Pravin Durugkar User Sync Activecampaign

Name of the Vulnerable Software and Affected Versions: Pravin Durugkar User Sync ActiveCampaign versions 1.3.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: Fo...

WordPress plugin Salvador – AI Image Generator 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL.WordPress plugin is an application plugin... A security...

CVE-2025-0484

A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical. This issue affects some unknown processing of the file /fladmin/sysconfigdoedit.php of the component Backend. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit h...

MOXA EDS-508A 安全漏洞

MOXA EDS-508A is a switch from China MOXA MOXA. A security vulnerability exists in the MOXA EDS-508A version 3.11 and earlier versions, which stems from a flaw in the authorization mechanism that makes it susceptible to authentication bypass attacks...