13619 matches found
CVE-2025-58685 WordPress Cecabank WooCommerce plugin plugin <= 0.3.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in cecabank Cecabank WooCommerce Plugin cecabank-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cecabank WooCommerce Plugin: from n/a through = 0.3.4...
CVE-2025-57438
The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are intended to be accessible only after the admin explicitly grants access to a manager-level account. However, a manager-level user can bypass these controls by intercepting and modifyi...
CVE-2025-57438
The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are intended to be accessible only after the admin explicitly grants access to a manager-level account. However, a manager-level user can bypass these controls by intercepting and modifyi...
PT-2025-38759
Name of the Vulnerable Software and Affected Versions 2wcom IP-4c version 2.15.5 Description The 2wcom IP-4c device version 2.15.5 is subject to a Broken Access Control issue. Manager-level users can bypass intended access restrictions on sensitive endpoints by intercepting and modifying requests...
WordPress imEvent Theme <= 3.4.0 is vulnerable to Broken Access Control
Software imEvent Type Theme Vulnerable versions = 3.4.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-58243 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 8a9b5f890122 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber...
CVE-2025-57438
The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are intended to be accessible only after the admin explicitly grants access to a manager-level account. However, a manager-level user can bypass these controls by intercepting and modifyi...
WordPress WPLMS Theme <= 4.970 is vulnerable to Broken Access Control
Software WPLMS Type Theme Vulnerable versions = 4.970 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-58668 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b45c9c5a0459 Credits Rafie Muhammad Patchstack Required privile...
CVE-2025-57438
The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are intended to be accessible only after the admin explicitly grants access to a manager-level account. However, a manager-level user can bypass these controls by intercepting and modifyi...
WordPress Secure Passkeys plugin <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Passkey Exposure and Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Secure Passkeys versions = 1.2.1...
WordPress SureForms – Drag and Drop Form Builder for WordPress plugin <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation vulnerability
Missing Authorization to Authenticated Contributor+ Form Creation vulnerability discovered by Alex in WordPress Plugin SureForms versions = 1.12.0...
WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin WooCommerce Orders & Customers Exporter versions = 5.4...
WordPress Kubio AI Page Builder plugin <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation vulnerability
Missing Authorization to Authenticated Subscriber+ Limited Plugin Installation vulnerability discovered by wesley wcraft in WordPress Plugin Kubio AI Page Builder versions = 2.6.3...
WordPress WPLegalPages plugin <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation vulnerability
Missing Authorization to Authenticated Contributor+ Arbitrary Plugin Installation vulnerability discovered by wesley wcraft in WordPress Plugin WPLegalPages versions = 3.4.3...
WordPress Essential Addons for Elementor plugin <= 6.2.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Peter Thaleikis in WordPress Plugin Essential Addons for Elementor versions = 6.2.4...
WordPress Sydney Theme <= 2.56 is vulnerable to Broken Access Control
Software Sydney Type Theme Vulnerable versions = 2.56 Fixed in 2.57 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-8999 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2b984ceb50d6 Credits Dmitrii Ignatyev Required privilege...
CVE-2025-37125
A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS ECOS. Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly...
CVE-2025-37125 Broken access control vulnerability in Firewall Configuration Leads to Unauthorized Access to Internal Network Resources
A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS ECOS. Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly...
WordPress Wide Banner plugin <= 1.0.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Wide Banner versions = 1.0.4...
WordPress Blaze Demo Importer plugin <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install vulnerability
Missing Authorization to Authenticated Subscriber+ Limited Plugin Install vulnerability discovered by wesley wcraft in WordPress Plugin Blaze Demo Importer versions = 1.0.12...