15722 matches found
WordPress Subscriptions & Memberships for PayPal plugin <= 1.1.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by NumeX in WordPress Plugin Subscriptions & Memberships for PayPal versions = 1.1.7...
WordPress FluentCommunity plugin <= 2.0.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by daroo in WordPress Plugin FluentCommunity versions = 2.0.0...
WordPress Virtuaria PagBank / PagSeguro para Woocommerce plugin <= 3.6.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Virtuaria PagBank / PagSeguro para Woocommerce versions = 3.6.3...
WordPress Gutenverse plugin <= 3.2.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Denver Jackson in WordPress Plugin Gutenverse versions = 3.2.1...
WordPress The Aisle theme <= 2.9 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme The Aisle versions = 2.9...
WordPress Featured Post Creative plugin <= 1.5.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Featured Post Creative versions = 1.5.5...
WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Que Thanh Tuan in WordPress Plugin Travelfic Toolkit versions = 1.3.3...
CVE-2025-64066
Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts in the application's local database...
EUVD-2025-199639
The Primakon Pi Portal 1.0.18 API /api/V2/ppudfvadmin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH...
EUVD-2025-199617
Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts in the application's local database...
WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Bonds in WordPress Plugin Elementor Website Builder versions = 3.33.0...
WordPress Fluent Booking plugin <= 1.9.11 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Theodoros Malachias in WordPress Plugin Fluent Booking versions = 1.9.11...
WordPress UsersWP plugin <= 1.2.47 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin UsersWP versions = 1.2.47...
CVE-2025-12629
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2025-64066
Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts in the application's local database...
CVE-2025-64066
Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts in the application's local database...
CVE-2025-64066
The CVE-2025-64066 entry concerns Primakon Pi Portal 1.0.18. The /api/v2/user/register endpoint is missing authorization checks, allowing unauthenticated POST requests to create local user accounts. This breaks the intended security model that relies on an external Identity Provider for initial r...
PT-2025-48066
Name of the Vulnerable Software and Affected Versions Primakon Pi Portal version 1.0.18 Description The /api/v2/user/register endpoint in Primakon Pi Portal is susceptible to a Broken Access Control issue. The endpoint does not enforce authorization checks, enabling unauthenticated attackers to...
WordPress Show Variations as Single Products Woocommerce plugin <= 2.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Show Variations as Single Products Woocommerce versions = 2.0...