15740 matches found
CVE-2025-40773
A vulnerability has been identified in SiPass integrated All versions V3.0. Affected server applications contains a broken access control vulnerability. The authorization mechanism lacks sufficient server-side checks, allowing an attacker to execute a specific API request. Successful exploitation...
EUVD-2025-34158
A vulnerability has been identified in SiPass integrated All versions V3.0. Affected server applications contains a broken access control vulnerability. The authorization mechanism lacks sufficient server-side checks, allowing an attacker to execute a specific API request. Successful exploitation...
WordPress Welcart e-Commerce plugin <= 2.11.24 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Welcart e-Commerce versions = 2.11.24...
CVE-2025-9265
A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version late...
PT-2026-37102
Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.0.0 Description Broken TLS validation logic in the OVN database connection logic allows connections to an attacker's OVN database. The OVN client implementations disable standard Go TLS server verification and use a...
PT-2025-41885
Name of the Vulnerable Software and Affected Versions SiPass integrated versions prior to 3.0 Description A broken access control issue exists in SiPass integrated server applications. The authorization mechanism does not have enough server-side checks, which allows an attacker to execute a...
WordPress SureForms – Drag and Drop Form Builder for WordPress plugin <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure vulnerability
Missing Authorization to Authenticated Contributor+ Information Disclosure vulnerability discovered by Abu Hurayra HurayraIIT in WordPress Plugin SureForms versions = 1.12.1...
WordPress ChatBot plugin <= 7.7.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin ChatBot versions = 7.7.3...
Nextcloud: BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data
Summary The Out-of-Office OOO API endpoints at /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId and /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId/now suffer from a Broken Object Level Authorization BOLA vulnerability. Any authenticated user can retrieve the out-of-office data of any other user by...
WordPress GSheetConnector For Gravity Forms plugin <= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by wesley wcraft in WordPress Plugin Gravity Forms Google Sheet Connector versions = 1.3.27...
CVE-2025-9265
A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version late...
WordPress Newsup Theme <= 5.0.10 is vulnerable to Broken Access Control
Software Newsup Type Theme Vulnerable versions = 5.0.10 Fixed in 5.0.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-8682 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9037492b67e8 Credits Dmitrii Ignatyev Required privilege...
CVE-2025-61665
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the getrelatoriossocios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and...
WordPress ChatBot plugin <= 7.3.9 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by n0arafatn0 in WordPress Plugin ChatBot versions = 7.3.9...
WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin MasterStudy LMS Pro versions 4.7.16...
WordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Masterstudy Elementor Widgets versions = 1.2.4...
WordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Masterstudy Elementor Widgets versions = 1.2.4...
WordPress Masterstudy theme < 4.8.122 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme Masterstudy versions 4.8.122...
WordPress Porto Theme - Functionality plugin < 3.7.3 - Broken Access Control vulnerability
WordPress Porto Theme - Functionality plugin 3.7.3 - Broken Access Control vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Porto Theme - Functionality versions 3.7.3...