15726 matches found
PT-2025-48066
Name of the Vulnerable Software and Affected Versions Primakon Pi Portal version 1.0.18 Description The /api/v2/user/register endpoint in Primakon Pi Portal is susceptible to a Broken Access Control issue. The endpoint does not enforce authorization checks, enabling unauthenticated attackers to...
CVE-2025-64066
The CVE-2025-64066 entry concerns Primakon Pi Portal 1.0.18. The /api/v2/user/register endpoint is missing authorization checks, allowing unauthenticated POST requests to create local user accounts. This breaks the intended security model that relies on an external Identity Provider for initial r...
WordPress Show Variations as Single Products Woocommerce plugin <= 2.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Show Variations as Single Products Woocommerce versions = 2.0...
WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by daroo in WordPress Plugin PropertyHive versions = 2.1.12...
WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by daroo in WordPress Plugin PropertyHive versions = 2.1.12...
EUVD-2025-198619
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2025-12629
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2025-12629
The CVE applies to WordPress plugin Broken Link Manager (versions
CVE-2025-12629 Broken Link Manager <= 0.6.5 - Reflected XSS
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2025-12629 Broken Link Manager <= 0.6.5 - Reflected XSS
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WordPress plugin Broken Link Manager 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
PT-2025-47886
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WordPress Timetics plugin <= 1.0.44 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by MD ISMAIL in WordPress Plugin Timetics versions = 1.0.44...
WordPress Modula Image Gallery plugin <= 2.13.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Que Thanh Tuan in WordPress Plugin Modula Image Gallery versions = 2.13.6...
WordPress Custom Order Numbers for WooCommerce plugin <= 1.11.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Custom Order Numbers for WooCommerce versions = 1.11.0...
JLSEC-2025-221 Use of a Broken or Risky Cryptographic Algorithm in the function `mbedtls_mpi_exp_mod()` in lignum.c...
Use of a Broken or Risky Cryptographic Algorithm in the function mbedtlsmpiexpmod in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information typically an untrusted operating system attacking a...
CVE-2025-62293
SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55...
CVE-2025-66114
CVE-2025-66114 refers to a Missing Authorization / Broken Access Control in the WordPress plugin Show Variations as Single Products Woocommerce (plugin <= 2.0). The vulnerability enables access control bypass for variations data; exploitation details, affected versions (
CVE-2025-66110
CVE-2025-66110 affects the WordPress plugin TikTok Feed (b-tiktok-feed) up to version 1.0.22, labeled as a Missing Authorization / Broken Access Control vulnerability. The issue arises from misconfigured access control security levels, enabling unauthorized access per the CVE description. Public ...
CVE-2025-66110 WordPress Tiktok Feed plugin <= 1.0.23 - Broken Access Control vulnerability
Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tiktok Feed: from n/a through = 1.0.23...