PT-2026-106491

Unauthenticated Broken Access Control in BEAR = 1.2.2 versions...

PT-2026-106322

Unauthenticated Broken Access Control in FluentBooking Pro 2.5.0 versions...

PT-2026-106327

Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...

PT-2026-106404

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce = 1.1.2606090 versions...

PT-2026-106423

Subscriber Broken Access Control in App for Cloudflare® = 1.10.1 versions...

PT-2026-106484

Unauthenticated Broken Access Control in Sermon'e = 1.0.2 versions...

PT-2026-106482

Unauthenticated Broken Access Control in Easy Digital Downloads = 3.7.1 versions...

PT-2026-106469

Unauthenticated Broken Access Control in WXD Backup Lite = 1.0.2 versions...

PT-2026-106393

Subscriber Broken Access Control in WP2LEADS = 3.5.7 versions...

PT-2026-106462

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily = 1.0.8 versions...

CVE-2025-25616

CVE-2025-25616 Unifiedtransform v2.0 में अनुचित पहुँच नियंत्रण Incorrect Access Control की कमजोरी है, जिससे छात्र परीक्षा नियमों में बदलाव कर सकते हैं। प्रभावित एंडपॉइंट /exams/edit-rule?examruleid=1 है। विक्रेता: Unifiedtransform PoC चरण 1: एप्लिकेशन में एक छात्र के रूप में लॉग इन करें। चरण 2:...

CVE-2025-25621

CVE-2025-25621 Unifiedtransform v2.0 معرّض لثغرة التحكم غير الصحيح في الوصول، مما يسمح للمعلمين بتسجيل حضور زملائهم المعلمين من خلال المسار /courses/teacher/index?teacherid=2&semesterid=1. البائع: Unifiedtransform PoC الخطوة 1: سجّل الدخول إلى التطبيق بصفة معلّم. الخطوة 2: انتقل إلى المسار...

CVE-2026-11991-Exploit

CVE-2026-11991 — نشر النماذج غير المصرح به في FlowForms تجاوز التفويض مساهم+ لنشر أي نموذج مسودة في FlowForms ≤ 1.1.1 نظرة عامة على الثغرة الخاصية| القيمة ---|--- معرف CVE| CVE-2026-11991 درجة CVSS| 6.2 — متوسطة متجه CVSS| AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:H/RL:O/RC:C CWE| CWE-639 تجاوز التفو...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection बिगड़ा पहुँच नियंत्रण MISP के बल्क डिलीट फ़्लो में इवेंट रिपोर्ट और शेयरिंग ग्रुप के लिए लापता प्राधिकरण दोष का अवधारणा प्रमाण। deleteSelection हैंडलर प्रत्येक चयनित आइटम को एक कॉलबैक के साथ प्राधिकृत करते हैं जो आइटम को अनदेखा करता है और कॉल करने वाले की...

CVE-2026-105637

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...

CVE-2026-103337 WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2...

CVE-2026-103337 WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2...

CVE-2026-103337

The Kirillbdev WC Ukraine Shipping plugin for WordPress is vulnerable to a Broken Access Control flaw (CWE-862) in versions up to and including 1.23.2 . The vulnerability stems from Missing Authorization , which allows for the exploitation of incorrectly configured access control security levels....

CVE-2025-25615

CVE-2025-25615 Unifiedtransform v2.0 عرضة لضعف التحكم في الوصول غير الصحيح، مما يسمح للمدراء بعرض قائمة الحضور لجميع أقسام الفصول الدراسية. البائع: Unifiedtransform PoC الخطوة 1: قم بتسجيل الدخول إلى التطبيق كمعلم. الخطوة 2: انتقل إلى نقطة النهاية التالية:...

CVE-2026-97303 WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2...