13997 matches found
WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by babyhack@OPCIA in WordPress Plugin Return Refund and Exchange For WooCommerce versions = 4.6.4...
WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by HaiND in WordPress Plugin IMPress for IDX Broker versions = 3.3.0...
Astro - Broken Access Control
Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers. id: CVE-2025-64525...
Modular DS - Broken Access Control
Modular DS = 2.5.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions. id: CVE-2026-23550 info: name: Modular DS - Broken Access Control author: DhiyaneshDk,l46983284-cpu...
CMP WordPress < 4.0.19 - Broken Access Control
CMP WordPress plugin 4.0.19 contains an arbitrary page layout change caused by insufficient access control in the coming soon page feature, letting unauthenticated users modify the layout, exploit requires no authentication. id: CVE-2022-0188 info: name: CMP WordPress 4.0.19 - Broken Access Contr...
Couchbase Server - Broken Access Control
Couchbase Server versions 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0-4.6.5, 5.0.0, 5.1.1, 5.5.0, and 5.5.1 contain insecure permissions for the projector and indexer REST endpoints caused by unauthenticated access, letting attackers access administrative APIs without authentication, exploit require...
CVE-2026-77132
TYPO3 CMS is vulnerable to an information disclosure flaw in the backend localization wizard . Several AJAX routes used by this feature failed to perform authorization checks, allowing authenticated, low-privileged backend users to access information about records and content elements outside the...
EUVD-2026-72676
It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...
grafana: Grafana: Privilege escalation via broken access control
A flaw was found in Grafana. This vulnerability, categorized as broken access control, allows an attacker to bypass security mechanisms in a web application. This can lead to unauthorized access to sensitive data, enable operations on behalf of other users, and potentially result in privilege...
CVE-2026-81781 WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...
CVE-2026-81781
Unbounce Landing Pages WordPress plugin (versions through 1.1.4 ) is affected by a Missing Authorization (Broken Access Control) vulnerability, allowing an attacker with low privileges to exploit incorrectly configured access control security levels. The CVSS 3.1 score is 7.1 (HIGH) , with a netw...
CVE-2026-81781 WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...
CVE-2026-81790 WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8...
CVE-2026-81790
CVE-2026-81790 affects the WordPress plugin Csomagpontok és szállítási címkék WooCommerce-hez (Hungarian Pickup Points for WooCommerce) by Viszt Péter. A Missing Authorization (Broken Access Control) vulnerability allows unauthenticated, network-based attackers to exploit incorrectly configured a...
CVE-2026-81790 WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8...
CVE-2026-76962
SAP S/4HANA (Manage Bank Chains app) has insufficient authorization checks that allow an attacker with low privileges to send specially crafted requests to delete entries they should not be able to access. The impact is limited to availability (low severity), with no stated impact on confidential...
PT-2026-88502
Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name...
CVE-2026-86438
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...