CVE-2026-81194

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...

CVE-2026-81198

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...

CVE-2026-77764

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them...

CVE-2026-74927

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications...

CVE-2026-77784

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

CVE-2026-77785

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-12526

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2024-8949-POC

在 Sourcecodester 在线眼镜商城网站中发现越权访问漏洞：ID、购物车 ID 操纵导致用户的购物车被添加和删除非意愿的商品 CVE-2024-8949 厂商：Sourcecodester https://www.sourcecodester.com/php/16089/online-eyewear-shop-website-using-php-and-mysql-free-download.html 参考：https://github.com/gurudattch/ 产品：Online Eyewear Shop 版本：1.0 漏洞概述： Sourcecodester 开发的...

EUVD-2026-69854

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

EUVD-2026-69840

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-77784 Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

CVE-2026-77784

Rank Math SEO (WordPress plugin) versions before 1.0.277 suffer from an authorization bypass in the mark_page_as function: the plugin does not verify that the requesting user is permitted to edit the target object before updating its SEO indexing metadata (Robots and Pillar Content settings). An ...

EUVD-2026-69835

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications...

CVE-2026-77764 GamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them...

CVE-2026-15232 Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

EUVD-2026-69871

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-54415-PoC

CVE-2026-54415 — Azuriom CMSの破損したアクセス制御 → アカウント乗っ取り Azuriom CMS 1.2.11 の管理サーバー管理ルートにおける認可の欠如により、admin.access のみを持つ低権限管理者が AzLink サーバートークンを生成し、管理者以外の任意のアカウントを乗っ取ることができます。...

CVE-2023-22515-Scan

CVE-2023-22515-Scan 关于 这是一个简单的扫描器，用于检测 CVE-2023-22515，这是一个在 Atlassian Confluence Data Center 和 Server 中存在的严重漏洞，正被威胁行为者在野外积极利用，以“创建未授权的 Confluence 管理员账户并访问 Confluence 实例”。该漏洞最初被描述为“权限提升”问题，但 Atlassian 后来在其安全公告中将其分类更改为“访问控制失效”。 CVE-2023-22515 时间线 2023年10月4日：Atlassian 发布了关于 CVE-2023-22515...

confluence-cve-2023-22515

confluence-cve-2023-22515 Confluence Control de Acceso Roto : CVE-2023-22515...

CVE-2025-22828

CVE-2025-22828 📜 描述 Apache CloudStack 4.16.0 及更高版本存在一个访问控制缺陷，允许知道资源 UUID 的用户读取或添加他们无权访问的资源上的评论（注释）。UUID 可能会在应用程序的各个部分暴露，例如当用户最初有权访问某个资源，但因管理限制而后来失去访问权限时。 🔍 漏洞详情 类型: 访问控制缺陷 影响: 未经授权访问注释及潜在敏感数据 受影响版本: 4.16.0 及更高版本 CWE: 向未授权行为者暴露敏感信息 CWE-200 🎬 演示视频 未经授权访问注释（listAnnotations 命令） 未经授权添加注释（addAnnotation...