WordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jarno Vos jrn5151 in WordPress Plugin Mobile builder versions = 1.4.2...

CVE-2025-64236

CVE-2025-64236 affects the WordPress Tuturn plugin (versions before 3.6). The issue is a broken authentication vulnerability allowing authentication bypass via an alternate path or channel, enabling authentication abuse. Remediation: update to Tuturn 3.6 or later. If exploitation details are not ...

CVE-2025-60079

CVE-2025-60079 affects the WordPress Parallax Section block plugin (versions up to and including 1.0.9). The root cause is Missing Authorization, allowing functionality to be accessed without proper ACL constraints. Impact is described as access to restricted functionality due to broken authentic...

CVE-2025-60079 WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability

Missing Authorization vulnerability in bPlugins Parallax Section block parallax-section allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Parallax Section block: from n/a through = 1.0.9...

CVE-2025-60079 WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability

Missing Authorization vulnerability in bPlugins Parallax Section block parallax-section allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Parallax Section block: from n/a through = 1.0.9...

WordPress JAY Login & Register plugin <= 2.4.01 - Authentication Bypass via Cookie vulnerability

Authentication Bypass via Cookie vulnerability discovered by kr0d in WordPress Plugin JAY Login & Register versions = 2.4.01...

WordPress Campay Woocommerce Payment Gateway plugin <= 1.2.2 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Campay Woocommerce Payment Gateway versions = 1.2.2...

Broken Authentication Third-Party Dependency in Bitbucket Data Center and Server - CVE-2025-22228

This High severity vulnerability known as CVE-2025-22228 was introduced in 8.19.0, 8.19.1, 8.19.2, 8.19.3, 8.19.4, 8.19.5, 8.19.6, 8.19.7, 8.19.8, 8.19.9, 8.19.10, 8.19.11, 9.4.0, 8.19.12, 8.19.13, 9.4.1, 9.4.2, 8.19.14, 9.4.3, 8.19.15, 8.19.16, 9.4.4, 8.19.17, 9.4.5, 8.19.18, 9.4.6 of Bitbucket...

CVE-2025-12998 Broken Authentication in extension “Modules” (modules)

Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5...

WordPress Ace User Management plugin <= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest vulnerability

Subscriber+ Authentication Bypass via Password Rest vulnerability discovered by aschoiloa1890 in WordPress Plugin Ace User Management versions = 2.0.3...

CVE-2025-62064 WordPress Search & Go theme <= 2.7 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This issue affects Search & Go: from n/a through = 2.7...

CVE-2025-49394 WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerability

Missing Authorization vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a...

CVE-2025-49394

The WordPress Image Gallery block (plugin) with versions up to 1.0.7 is affected by a Missing Authorization vulnerability caused by insufficient access-control checks in multiple functions, allowing authenticated users with Subscriber-level access and above to view/activate plugins and access fun...

When APIs Become Attack Paths: What the Q3 2025 ThreatStats Report Tells Us

Wallarm’s latest Q3 2025 API ThreatStats report link placeholder reveals that API vulnerabilities, exploits, and breaches are not just increasing; they’re evolving. Malicious actors are shifting from code-level weaknesses to business logic flaws, from web apps to partner integrations, and from RE...

Vulnerabilities fixed in Rockwell Automation COMMS

Rockwell Automation has fixed vulnerabilities in COMMS NATR systems. The vulnerabilities include multiple broken authentication issues that pose serious risks, including denial-of-service attacks, possible takeovers of admin accounts and improper changes to NAT rules. In addition, there is a Stor...

WordPress Jobmonster Theme <= 4.8.1 is vulnerable to Broken Authentication

Software Jobmonster Type Theme Vulnerable versions = 4.8.1 Fixed in 4.8.2 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2025-5397 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 91f66baeb6e0 Credits Thái An...

Web-Security-Assessment-Suite-based-on-OWASP-Top-10

Web-Security-Assessment-Suite-based-on-OWASP-Top-10 A...

WordPress Search & Go theme <= 2.7 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Search & Go versions = 2.7...

WordPress Event Tickets and Registration plugin <= 5.26.5 - Unauthenticated Ticket Payment Bypass vulnerability

Unauthenticated Ticket Payment Bypass vulnerability discovered by Jack Pas Dark. in WordPress Plugin Event Tickets versions = 5.26.5...

WordPress WP Private Content Plus plugin <= 3.6.2 - Password Protection Bypass vulnerability

Password Protection Bypass vulnerability discovered by Lorenzo Camilli in WordPress Plugin WP Private Content Plus versions = 3.6.2...