CVE-2020-25026

The sfeventmgt aka Event management and registration extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure participant data, and event data via email because of Broken Access Control...

WordPress Booking and Rental Manager plugin <= 2.3.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ghsinfosec in WordPress Plugin Booking and Rental Manager versions = 2.3.8...

WordPress CryptoCloud - Crypto Payment Gateway plugin <= 2.1.2 - Broken Access Control vulnerability

WordPress CryptoCloud - Crypto Payment Gateway plugin = 2.1.2 - Broken Access Control vulnerability discovered by ch4r0n in WordPress Plugin CryptoCloud - Crypto Payment Gateway versions = 2.1.2...

WordPress StyleAI plugin <= 1.0.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin StyleAI versions = 1.0.4...

WordPress Simple Business Directory Pro plugin < 15.6.9 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Phat RiO in WordPress Plugin Simple Business Directory Pro versions 15.6.9...

CVE-2019-19223

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface Firmware EU1.03 allows an attacker to reboot the router by submitting a reboot.html GET request without being authenticated on the admin interface...

CVE-2019-19224

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface Firmware EU1.03 allows an attacker to download the configuration binary file settings by submitting a rom-0 GET request without being authenticated on the admin interface...

CVE-2019-19226

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface Firmware EU1.03 allows an attacker to enable or disable MAC address filtering by submitting a crafted Forms/WlanMacFilter1 POST request without being authenticated on the admin interface...

CVE-2014-125105

A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function optionspage of the file core/core.php of the component Settings Page. The manipulation of the argument exclusionlist/blccustomfiel...

CVE-2019-9158

Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control...

CVE-2019-14273

In SilverStripe assets 4.0, there is broken access control on files...

CVE-2019-19225

A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface Firmware EU1.03 allows an attacker to change DNS servers without being authenticated on the admin interface by submitting a crafted Forms/dns1 POST request...

CVE-2019-16399

Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/systemadvanced.php?lang=en and login with the default root password welc0me...

CVE-2015-9468

The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action...

CVE-2019-17207

A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker aka Broken Link Checker plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the...

CVE-2015-9453

The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist...

CVE-2015-9467

The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter...

Drupal Quick Node Block module < 2.0.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Mitch Portier arkener in WordPress Module Quick Node Block versions 2.0.0...

WordPress Splitit plugin <= 4.2.8 - Missing Authorization to Multiple Administrative Actions vulnerability

Missing Authorization to Multiple Administrative Actions vulnerability discovered by Sushi Com Abacate in WordPress Plugin Splitit versions = 4.2.8...

CVE-2025-47941 TYPO3 Has Broken Authentication in Backend MFA

TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, the multifactor authentication MFA dialog presented during backend login can be bypassed due to insufficient enforcement of access...