WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dcs in WordPress Plugin CURCY versions = 2.2.17...

CVE-2026-105062 WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17...

CVE-2026-105062 WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17...

CVE-2026-105062

The Brandtoss WP Admin Audit plugin for WordPress (versions n/a through 1.2.17 ) is vulnerable to a Missing Authorization vulnerability (CWE-862). This issue allows for exploiting incorrectly configured access control security levels . The impact is categorized as Medium severity with a CVSS3.1 s...

WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nixxies in WordPress Plugin WP Admin Audit versions = 1.2.17...

CVE-2026-104386

The WP VR (wpvr) plugin for WordPress, versions n/a through 9.1.3 , is affected by a Broken Access Control vulnerability (CWE-862 ). The flaw allows for exploiting incorrectly configured access control security levels due to missing authorization. The impact includes potential changes to confiden...

CVE-2026-104386 WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3...

CVE-2026-104386 WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3...

WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Zac Lou in WordPress Plugin WP VR versions = 9.1.3...

CVE-2023-49982

CVE-2023-49982 School Fees Management System v1.0 - Control de acceso incorrecto - Escalada de privilegios Descripción : El control de acceso incorrecto en School Fees Management System v1.0 permite a los atacantes escalar privilegios y realizar acciones administrativas, incluyendo agregar y...

CVE-2023-30486

CVE-2023-30486 Square = 2.0.0 - Autorización faltante mediante activateplugin Descripción El tema Square para WordPress es vulnerable a la activación no autorizada de plugins debido a una falta de verificación de capacidades en la función activateplugin llamada mediante una acción AJAX en version...

CVE-2024-50945

CVE-2024-50945 描述 SimplCommerce 在评论系统中存在一个被破坏的访问控制漏洞，允许未授权用户为他们未购买的商品发布评论。 检测方法 攻击者可以通过向评论提交端点发送请求，并将 EntityId 更改为他们未购买的产品的 ID 来检测此漏洞。如果评论成功发布，则确认该网站存在被破坏的访问控制漏洞。 测试于 230310c8d7a0408569b292c5a805c459d47a1d8f 提交 链接 https://www.simplcommerce.com/ https://github.com/simplcommerce/SimplCommerce...

CVE-2026-54415-PoC

CVE-2026-54415 — Control de acceso roto en Azuriom CMS → Toma de control de cuenta La falta de autorización en las rutas de gestión de servidores del panel de administración en Azuriom CMS Este PoC se publica con fines defensivos y educativos contra una versión parcheada. Ejecútalo únicamente...

PT-2026-106035

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission...

PT-2026-106029

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description WorkspaceOwnerPermission does not verify if the is active variable is set to True when validating if a user is a workspace owner. This allows a deactivated user to maintain authorization and retain...

PT-2026-106044

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have ...

CVE-2024-3400-Check

Descripción 1. Realiza una solicitud POST al endpoint /ssl-vpn/hipreport.esp. 2. Realiza una solicitud GET a /global-protect/portal/images/sxy.txt para comprobar si la explotación permite el acceso al archivo, lo que normalmente estaría prohibido estado 403 Forbidden. Requisitos previos Necesitas...

CVE-2025-68723

CVE-2025-68723: XSS Almacenado en Axigen WebAdmin Resumen de la Vulnerabilidad Múltiples campos de entrada en la interfaz de Axigen WebAdmin carecen de la adecuada sanitización, lo que permite la ejecución de JavaScript malicioso. Estas vulnerabilidades permiten que un administrador con pocos...

CVE-2021-42671

CVE-2021-42671 CVE-2021-42671 - 工程师在线门户系统中的访问控制失效漏洞。 技术描述： 工程师在线门户（Engineers Online Portal）存在一个访问控制失效漏洞。攻击者可以利用此漏洞绕过访问控制，无需身份验证或授权即可获取上传到 Web 服务器的所有文件。 受影响域名 - http://localhost/niamunozmonitoringsystem/admin/uploads/ 概念验证（PoC）： 访问 http://localhost/niamunozmonitoringsystem/admin/uploads/ 即可绕过目标 We...

CVE-2025-68721

CVE-2025-68721: Axigen WebAdmin Broken Access Control Vulnerability Summary A flaw in the permission logic allows an administrator account with zero permissions to access the "Security & Filtering" page, specifically the SSL Certificates endpoint. While other restricted sections are correctly...