WordPress Case Theme User plugin <= 1.0.3 - Authentication Bypass via Social Login vulnerability

Authentication Bypass via Social Login vulnerability discovered by Foxyyy in WordPress Plugin Case Theme User versions = 1.0.3...

WordPress Simpler Checkout <= 1.1.13 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by kr0d in WordPress Plugin Simpler Checkout versions = 1.1.13...

WordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerability

Broken Authentication Vulnerability discovered by Rau má đậu xanh in WordPress Theme Golo versions = 1.7.0...

WordPress Jobmonster Theme <= 4.7.9 - Broken Authentication Vulnerability

Broken Authentication Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Jobmonster versions = 4.7.9...

WordPress Jobmonster Theme <= 4.7.9 is vulnerable to Broken Authentication

Software Jobmonster Type Theme Vulnerable versions = 4.7.9 Fixed in 4.8.0 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2025-54738 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 87e1e5542be4 Credits Tran Nguyen...

WordPress Golo Theme <= 1.7.0 is vulnerable to Broken Authentication

Software Golo Type Theme Vulnerable versions = 1.7.0 Fixed in 1.7.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2025-54725 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID a2ab39e8e113 Credits Aiden Required...

CVE-2025-54713 WordPress Taxi Booking Manager for WooCommerce plugin <= 1.3.0 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Authentication Abuse.This issue affects Taxi Booking Manager for WooCommerce: from n/a through = 1.3.0...

WordPress WooCommerce OTP Login With Phone Number, OTP Verification plugin <= 1.8.47 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Login with phone number versions = 1.8.47...

CVE-2025-54786

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting calendar...

CVE-2025-54786: Exposure of Sensitive Information to an Unauthorized Actor

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting calendar...

CVE-2025-54786 SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting calendar...

PT-2025-32230 · Suitecrm · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions 7.14.6 and 8.8.0 Description: SuiteCRM, an open-source Customer Relationship Management CRM software application, suffers from broken authentication within the legacy iCal service. This allows unauthenticated access to meeti...

WordPress Brave Conversion Engine (PRO) plugin <= 0.7.7 - Authentication Bypass to Administrator vulnerability

Authentication Bypass to Administrator vulnerability discovered by Thái An in WordPress Plugin Brave Conversion Engine PRO versions = 0.7.7...

WordPress WebinarIgnition plugin <= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass vulnerability

Unauthenticated Login Token Generation to Authentication Bypass vulnerability discovered by kr0d in WordPress Plugin WebinarIgnition versions = 4.03.32...

WordPress Orion Login with SMS plugin <= 1.0.5 - Authenticated Bypass via Weak OTP vulnerability

Authenticated Bypass via Weak OTP vulnerability discovered by kr0d in WordPress Plugin Orion Login with SMS versions = 1.0.5...

WordPress Post SMTP plugin <= 3.2.0 - Account Takeover Vulnerability

Account Takeover Vulnerability discovered by Denver Jackson Patchstack Alliance in WordPress Plugin Post SMTP versions = 3.2.0...

WordPress LoginPress Pro plugin <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider vulnerability

Authentication Bypass via WordPress.com OAuth provider vulnerability discovered by Foxyyy in WordPress Plugin LoginPress Pro versions = 5.0.1...

WordPress Simple Link Directory plugin < 14.8.1 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Simple Link Directory versions 14.8.1...

BASM (Broken Authentication & Session Management) org.springframework.security:spring-security-crypto Dependency in Jira Service Management Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 5.12.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0 and 10.7.0 of Jira Service Management Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.4 and a CVSS Vector of...

BASM (Broken Authentication and Session Management) org.apache.tomcat:tomcat-catalina Dependency in Jira Software Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 10.3.0 and 10.7.1 of Jira Software Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N allows an...