21 matches found
WordPress Block User Account plugin < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords vulnerability
Subscriber+ Account Block Bypass via Application Passwords vulnerability discovered by Farid Narimanov in WordPress Plugin Block User Account versions 2.0.1...
CVE-2026-18960
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...
CVE-2026-18960 Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...
CVE-2026-18960 Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...
EUVD-2026-55011
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...
CVE-2026-18960
The Block User Account WordPress plugin, in versions prior to 2.0.1 , contains a vulnerability where it fails to enforce account blocks across all authentication paths. A blocked user who possesses an application password created before the block was applied can maintain full role-level read and ...
CVE-2026-18960
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...
CVE-2026-18960: Improper Authentication
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...
CVE-2026-27954
Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints holdaction.php, blockuser.php, and transferchat.php load chat objects by ID without calling erLhcoreClassChat::hasAccessToRead, allowing operators t...
CVE-2026-27954
Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints holdaction.php, blockuser.php, and transferchat.php load chat objects by ID without calling erLhcoreClassChat::hasAccessToRead, allowing operators t...
CVE-2026-27954 LiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpoints
Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints holdaction.php, blockuser.php, and transferchat.php load chat objects by ID without calling erLhcoreClassChat::hasAccessToRead, allowing operators t...
CVE-2025-55028
Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks. This vulnerability was fixed in Firefox for iOS 142...
CVE-2025-55028 JavaScript alerts could impede UI interaction or allow denial of service attacks
Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks. This vulnerability was fixed in Firefox for iOS 142...
CVE-2025-55028
Mozilla Firefox for iOS is affected by a denial of service vulnerability prior to version 142 . Malicious scripts utilizing repetitive JavaScript alerts can prevent client user interaction in certain scenarios, potentially leading to a service failure. This issue was addressed in version 142 . Ex...
ublk: don't allow user copy for unprivileged device
...
CVE-2023-37303
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message...
CVE-2023-37303: Improper Check for Unusual or Exceptional Conditions
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message...
grafana: using email as a username can block other users from signing in
A flaw was found in the Grafana web application. When a user logs into the system, either the username or email address can be used. However, the login system allows both a username and connected email to be registered, which could allow an attacker to prevent a user which has an associated email...
grafana: using email as a username can block other users from signing in
A flaw was found in the Grafana web application. When a user logs into the system, either the username or email address can be used. However, the login system allows both a username and connected email to be registered, which could allow an attacker to prevent a user which has an associated email...
No Rate Limit on Copoun Code Functionality
Description The attacker has the ability to send any number of requests to the endpoint due to the absence of rate-limiting. Steps to reproduce - Simply capture the adding coupon request and send it to burp. - Send it to the repeater tab and you will be able to send many requests without blocking...