CVE-2019-13403

CVE-2019-13403 Report: Maggio 2019 Fix: Maggio 2019 Credito: B3Bo1d Descrizione Temenos CWX versione 8.9 presenta una vulnerabilità di Broken Access Control nel modulo /CWX/Employee/EmployeeEdit2.aspx, che porta alla visualizzazione delle informazioni utente. PoC Prima Dopo Riferimento...

CVE-2026-27541-Analysis-Lab

CVE-2026-27541 — Laboratorio di Escalation dei Privilegi Autenticata in WooCommerce Wholesale Prices Panoramica Questo progetto è un laboratorio Docker locale per analizzare e riprodurre il comportamento di CVE-2026-27541 nel plugin WooCommerce Wholesale Prices / Wholesale Suite , confrontando le...

CVE-2024-8949-POC

Vulnerabilità di controllo degli accessi inadeguato scoperta in Sourcecodester Online Eyewear Shopping Website - La manipolazione dell'ID del carrello porta all'aggiunta e alla rimozione indesiderata di articoli nel carrello dell'utente CVE-2024-8949 Venditore: Sourcecodester...

DELMIA Apriso - Broken Access Control

DELMIA Apriso Release 2020 through Release 2025 contains a broken access control vulnerability caused by missing authorization, letting attackers gain privileged access to the application, exploit requires no special conditions. id: CVE-2025-6205 info: name: DELMIA Apriso - Broken Access Control...

confluence-cve-2023-22515

confluence-cve-2023-22515 Confluence में भंग पहुँच नियंत्रण : CVE-2023-22515...

CVE-2026-81346

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

CVE-2026-81200

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

CVE-2026-18233

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

EUVD-2026-68065

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

EUVD-2026-68060

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

EUVD-2026-68052

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...

CVE-2026-18234 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

CVE-2026-18233

CVE-2026-18233 affects the MStore API WordPress plugin before 4.21.1 . The plugin fails to verify that an order targeted by one of its delivery endpoints actually belongs to the requester. This allows any authenticated user—even those with the lowest Subscriber role—to mark arbitrary orders as co...

CVE-2026-18233 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

CVE-2025-22828

CVE-2025-22828 📜 Descrizione Apache CloudStack dalla versione 4.16.0 in poi presenta un problema di controllo degli accessi non corretto che consente a utenti con conoscenza degli UUID delle risorse di leggere o aggiungere commenti annotazioni su risorse a cui non sono autorizzati ad accedere. Gl...

EUVD-2026-66394

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

CVE-2026-55867 Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/userId/tokens/idOrToken endpoint implemented by UsersResource.revokeToken in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERSTOKENREMOVE...

CVE-2026-55867

Graylog (a log management platform) is affected in versions 6.2.0 through 6.3.12, 7.0.7, and 7.1.2 . The vulnerability resides in the DELETE /users/{userId}/tokens/{idOrToken} endpoint (UsersResource.revokeToken()), where the USERS_TOKENREMOVE permission is checked against an attacker-controlled ...

CVEs

Exploits de Prova de Conceito de CVE da Rhino Uma coleção de scripts de exploit de prova de conceito escritos pela equipe do Rhino Security Labs para várias CVEs. CVE-2025-32815: Bypass de Autenticação no Infoblox NetMRI via Credenciais Embutidas CVE-2025-32814: Injeção de SQL Não Autenticada no...

CVE-2026-82283

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...