13531 matches found
CVE-2025-59111
CVE-2025-59111 : Windu CMS is affected by Broken Access Control in the user editing functionality. A privileged attacker can issue a GET request to delete Super Admins, an action not possible via the GUI. The issue has been tested only on version 4.1 and is fixed in version 4.1 build 2250. Other ...
WordPress Essential Addons for Elementor plugin <= 6.5.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Bonds in WordPress Plugin Essential Addons for Elementor versions = 6.5.5...
CVE-2025-40548 SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability
A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under...
CVE-2025-40548 SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability
A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under...
CVE-2025-40548
SolarWinds Serv-U is affected by a set of flaws (CVE-2025-40547, -40548, -40549) stemming from a missing validation that could allow an attacker with admin privileges to execute code. Several connected sources indicate Serv-U versions prior to 15.5.3 (and specifically 15.5.2 and earlier per PT-20...
WordPress CBX Bookmark & Favorite plugin <= 2.0.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin CBX Bookmark & Favorite versions = 2.0.1...
PT-2025-47394
Name of the Vulnerable Software and Affected Versions Eurolab ELTS100 UBX version ELTS100v1.UBX Description The Eurolab ELTS100 UBX device is subject to Broken Access Control because of a lack of authentication on critical administrative endpoints. Attackers can directly access and modify sensiti...
CVE-2025-63225
The CVE-2025-63225 entry concerns Eurolab ELTS100_UBX (firmware ELTS100v1.UBX) with Broken Access Control due to missing authentication on critical administrative endpoints. The vulnerability allows remote attackers to directly access and modify sensitive system and network configurations, upload...
PT-2025-47390
Name of the Vulnerable Software and Affected Versions versions prior to 2025-37160 Description A broken access control BAC exists in the web-based management interface. An authenticated remote attacker with low privileges may be able to view sensitive information. Successful exploitation could le...
WordPress RestroPress plugin <= 3.2.3.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by daroo in WordPress Plugin RestroPress versions = 3.2.3.5...
WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Jitlada in WordPress Plugin WPFunnels versions = 3.6.2...
WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by daroo in WordPress Plugin Appointment Booking Calendar versions = 1.3.95...
WordPress Contest Gallery plugin <= 28.0.2 - Missing Authorization vulnerability
Missing Authorization vulnerability discovered by type5afe in WordPress Plugin Contest Gallery versions = 28.0.2...
WordPress All in One SEO plugin <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion vulnerability
Missing Authorization to Authenticated Contributor+ Arbitrary Media Deletion vulnerability discovered by shark3y in WordPress Plugin All In One SEO Pack versions = 4.8.9...
WordPress Image Gallery – Photo Grid & Video Gallery plugin <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move vulnerability
Improper Authorization to Authenticated Author+ Arbitrary Image File Move vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Modula Image Gallery versions = 2.12.28...
WordPress Qi Blocks plugin <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize vulnerability
Missing Authorization to Arbitrary Attachment Resize vulnerability discovered by Adrian Lukita in WordPress Plugin Qi Blocks versions = 1.4.3...
WordPress WP Google Review Slider plugin <= 17.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin WP Google Review Slider versions = 17.4...
WordPress WP Social Ninja plugin <= 3.20.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin WP Social Ninja versions = 3.20.1...
WordPress Lobo theme <= 2.8.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Lobo versions = 2.8.6...