15744 matches found
EUVD-2023-55675
Malicious code in bioql PyPI...
EUVD-2023-52348
Malicious code in bioql PyPI...
WordPress Constructor Theme <= 1.6.5 is vulnerable to Broken Access Control
Software Constructor Type Theme Vulnerable versions = 1.6.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-9194 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f6d9c8944054 Credits Sulabh Jain pentestmonkey11 Required...
CVE-2025-61665
WeGIA: Versions 3.4.12 and earlier are affected by a Broken Access Control vulnerability in the get_relatorios_socios.php endpoint that allows unauthenticated attackers to directly access sensitive members’ personal and financial information. The issue is fixed in version 3.5.0. Reported across m...
CVE-2025-61665 WeGIA: Broken Access Control in `get_relatorios_socios.php` Endpoint
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the getrelatoriossocios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and...
CVE-2025-61665 WeGIA: Broken Access Control in `get_relatorios_socios.php` Endpoint
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the getrelatoriossocios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and...
CVE-2025-61665 WeGIA: Broken Access Control in `get_relatorios_socios.php` Endpoint
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the getrelatoriossocios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and...
API Attack Awareness: Broken Object Level Authorization (BOLA) – Why It Tops the OWASP API Top 10
For this Cybersecurity Awareness Month, we thought it important to draw attention to some of the most common and dangerous API vulnerabilities. This week, we’re starting with Broken Object Level Authorization BOLA. BOLA vulnerabilities top the OWASP API Top Ten. And for good reason: they’re...
WordPress Jock On Air Now (JOAN) plugin <= 6.0.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Jock On Air Now JOAN versions = 6.0.4...
PT-2025-40428
Name of the Vulnerable Software and Affected Versions WeGIA versions 3.4.12 and below Description WeGIA, a web manager for charitable institutions, has a Broken Access Control issue. The get relatorios socios.php API endpoint allows unauthenticated attackers to directly access sensitive personal...
WordPress Custom Searchable Data Entry System plugin <= 1.7.1 - Unauthenticated Database Wiping vulnerability
Unauthenticated Database Wiping vulnerability discovered by Sean Murphy in WordPress Plugin Custom Searchable Data Entry System versions = 1.7.1...
WordPress Flights & Hotels Booking WP Plugin plugin <= 3.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Flights & Hotels Booking WP Plugin versions = 3.1...
WordPress SMS Contact Form 7 Notifications by ClickSend plugin <= 1.4.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin SMS Contact Form 7 Notifications by ClickSend versions = 1.4.0...
WordPress Effect Maker plugin <= 1.2.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Effect Maker versions = 1.2.1...
WordPress SmartCrawl SEO plugin <= 3.14.3 - Missing Authorization to Plugin Settings Update vulnerability
Missing Authorization to Plugin Settings Update vulnerability discovered by Rafshanzani Suhada in WordPress Plugin SmartCrawl versions = 3.14.3...
WordPress LatePoint plugin <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function vulnerability
Unauthenticated Authentication Bypass via loadstep Function vulnerability discovered by wesley wcraft in WordPress Plugin LatePoint versions = 5.1.94...
WordPress Smart WeTransfer plugin <= 1.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Smart WeTransfer versions = 1.3...
WordPress Referral Link Tracker plugin <= 1.1.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Referral Link Tracker versions = 1.1.4...
WordPress Ivory Search plugin <= 5.5.12 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin Ivory Search versions = 5.5.12...