CVE-2026-108550

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth...

CVE-2026-108550

The software SkillHub (versions before 0.2.22 ) is susceptible to an incorrect authorization vulnerability within the AccountMergeService and AccountMergeController components. This flaw allows authenticated attackers to perform an account takeover by abusing the account merge flow. Specifically,...

CVE-2026-108550 SkillHub before 0.2.22 Account Takeover via Account Merge Flow

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth...

CVE-2026-108550 SkillHub before 0.2.22 Account Takeover via Account Merge Flow

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth...

EUVD-2026-96345

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth...

EUVD-2026-96342

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted...

CVE-2024-43919

CVE-2024-43919 YARPP = 5.30.10 - Missing Authorization Description The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in the /includes/yarppprosetdisplaytypes.php file in all versions up to, and including,...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - Missing Authorization to Sensitive Information Exposure Description "The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it...

EUVD-2026-96338

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...

CVE-2026-108114

Strapi versions 5.47.0 through 5.57.0 are vulnerable to an improper authorization flaw (CWE-863) involving Admin API tokens. The root cause lies in the reconcileTokenPermissionsToUserCeiling function, which fails to account for token permissions containing omitted or null fields . Consequently, e...

CVE-2026-108114 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...

CVE-2026-108114 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...

CVE-2026-108165

Versions of Immich through 3.3.1 are vulnerable to a missing authorization flaw in the partner synchronization stream. The root cause is that synchronization queries fail to exclude Locked visibility, allowing authenticated partners to access Locked Folder asset metadata. An attacker with an acti...

EUVD-2026-96320

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...

CVE-2026-108165 Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...

CVE-2023-34035-Poc

CVE-2023-34035: Falsche Autorisierung...

CVE-2024-10124

CVE-2024-10124 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce = 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation Description The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized...

POC-CVE-2023-32681

POC for CVE-2023-32681 This is a Python 3 implementation of CVE-2023-32681, affecting clients using the requests version = 2.30.0. As per https://www.rfc-editor.org/rfc/rfc9110.htmlsection-15.4 whenever redirection 3xx is issued by the server then user-agent should modify the request to remove...

CVE-2025-3102

SureTriggers 🔥 Developed by 0xgh057r3c0n 📌 Vulnerability Details Plugin Name: SureTriggers Affected Versions: --newmail --newuser --newpassword 🔍 Example: python3 CVE-2025-3102.py -u https://target-site.com --newuser hacker --newpassword Pass123! 📋 Options Argument| Descri...

CVE-2024-54379

CVE-2024-54379 Minterpress = 1.0.5 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Minterpress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on a functio...