16312 matches found
CVE-2026-27541-Analysis-Lab
CVE-2026-27541 — WooCommerce Wholesale Prices Authenticated Privilege Escalation Lab Overview This project is a local Docker lab for analyzing and reproducing the behavior of CVE-2026-27541 in the WooCommerce Wholesale Prices / Wholesale Suite plugin by comparing vulnerable and patched builds...
CVE-2026-52200
UZ801 / ES-U3TS MifiService Broken Access Control Security advisory and technical notes for a broken access control issue in the embedded web management API exposed by MifiService.apk on the OEM / white-label UZ801v2.1 4G LTE mobile Wi-Fi platform, also observed marketed as ES-U3TS. This reposito...
CVE-2026-5465
CVE-2026-5465: Privilege Escalation in Amelia WordPress Plugin ⚠️ Executive Summary Critical Insecure Direct Object Reference IDOR vulnerability in the Amelia plugin that allows an authenticated user with the Employee Provider role to escalate privileges up to full Account Takeover of the WordPres...
CVE-2026-26417
CVE-2026-26417 Broken Access Control in Password Reset Functionality Vulnerability Summary A broken access control vulnerability was identified in Tata Consultancy Services TCS – Cognix Recon Client v3.0. The issue allowed authenticated users to reset passwords of arbitrary user accounts by...
CVE-2026-6201-IDOR
Broken Access Control in CodeAstro Online Job Portal Allows Arbitrary Job Deletion Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: Broken Access Control IDOR CWE: CWE-639 Affected File: /jobs/job-delete.php Parameter: id GET Impact: An...
cve-2026-32699-facturascripts-nick-bypass
CVE-2026-32699 - FacturaScripts EditUser Nick Parameter Broken Access Control Description Summary The application fails to validate the nick parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, a user can bypass this restriction using a proxy to...
CVE-2026-1375
CVE-2026-1375: Authenticated IDOR / Broken Access Control in Tutor LMS Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit systems...
CVE-2023-40362
CVE-2023-40362 CVE-2023-40362 vulnerabilitiy details and proof-of-concept. Overview An access control vulnerability in Click2Gov BP at the URI /Click2GovBP/mastercontractorlist.html leads to the ability for authenticated users to delete the contractors from the accounts of other users with the...
CVE-2026-26012
CVE-2026-26012 — Vaultwarden Cipher Enumeration PoC Full Cipher Enumeration Ignoring Organization Collection Permissions A proof-of-concept exploit for CVE-2026-26012, a broken access control vulnerability in Vaultwarden = 1.35.2 that allows any organization member to retrieve and decrypt all...
Exploit-CVE-2023-22515
Exploit CVE-2023-22515 A simple basch script exploit for CVE-2023-22515. Information Confluence Data Center and Server instances have a Broken Access Control Vulnerability CVE-2023-22515, allowing attackers to create unauthorized Confluence administrator accounts and access Confluence instances...
CVE-2026-40776
CVE-2026-40776 Eventin wp-event-solution Broken Access Control Unauthenticated PII disclosure and order forgery in the Eventin WordPress plugin 10,000+ active installs. A public REST endpoint hands out a wprest nonce to any visitor, and three downstream permission callbacks accept that nonce as a...
CVE-2024-0679
CVE-2024-0679 ColorMag = 3.1.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the pluginactioncallback function in all versions up...
confluence-cve-2023-22515
confluence-cve-2023-22515 Confluence Broken Access Control : CVE-2023-22515...
CVE-2023-45184
CVE-2023-45184 IBM i Access Client Solutions 1.1.9.4 - Local server broken access control. Timeline Vulnerability reported to vendor: 22.09.2023 New fixed 1.1.9.4 version released: 08.12.2023 Public disclosure: 15.12.2023 Description IBM i Access Client Solutions for storing temporary password...
CVE-2024-8949-POC
Broken Access Control Vulnerability was discoverd in Sourcecodester Online Eyewear Shopping Website ID,Cart ID Manipulation Leads to Unwanted Item Addition and Deletion into User's Cart CVE-2024-8949 Vendor: Sourcecodester...
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Matthew Lapinski in WordPress Plugin Event Tickets versions = 5.30.0.1...
CVE-2026-103072 WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VillaTheme Core: from n/a through 1.0.5...
CVE-2026-105888 WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1...