16010 matches found
WordPress Projectopia plugin <= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Option Deletion vulnerability discovered by Chuck in WordPress Plugin Projectopia versions = 5.1.16...
CVE-2025-39413 WordPress Simple Sitemap – Create a Responsive HTML Sitemap plugin <= 3.6.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through = 3.6.0...
CVE-2025-39413 WordPress Simple Sitemap – Create a Responsive HTML Sitemap plugin <= 3.6.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through = 3.6.0...
WordPress Section Widget plugin <= 3.3.1 - Path Traversal vulnerability
Path Traversal vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Section Widget versions = 3.3.1...
WordPress SureForms plugin < 1.4.4 - Contributor+ Settings Update vulnerability
Contributor+ Settings Update vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin SureForms versions 1.4.4...
Omise: Facebook Username Takeover via Broken Link in Footer
The Facebook username associated with the broken link in the footer was available for takeover. This could have allowed an attacker to create a fake Facebook page and mislead users into trusting it...
Unauthorized Access
moodle/moodle is vulnerable to Unauthorized Access. The vulnerability is due to broken access control and missing capability checks in certain grade reports, allowing unauthorized users to view restricted information...
WordPress WP Statistics plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary plugin Settings Update vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary plugin Settings Update vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin WP Statistics versions = 14.13.3...
curl: Use of a Broken or Risky Cryptographic Algorithm (CWE-327) in libcurl
Summary: The DES cipher Data Encryption Standard is used in the curlntlmcore.c file of libcurl. DES is considered insecure due to its short key length 56 bits and its susceptibility to brute-force attacks. Modern cryptographic standards recommend replacing DES with AES Advanced Encryption Standar...
Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2025-055)
The version of runc installed on the remote host is prior to 1.1.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-055 advisory. Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go...
WordPress SecuPress Free plugin <= 2.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by mikemyers in WordPress Plugin SecuPress Free versions = 2.3.9...
CVE-2025-39367 WordPress Kleo theme < 5.4.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in SeventhQueen Kleo.This issue affects Kleo: from n/a before 5.4.4...
WordPress Meta Keywords & Description plugin <= 0.8 - Local File Inclusion Vulnerability
Local File Inclusion Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Meta Keywords & Description versions = 0.8...
WordPress Kleo theme < 5.4.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Theme Kleo versions 5.4.4...
WordPress Kleo Theme < 5.4.4 is vulnerable to Broken Access Control
Software Kleo Type Theme Vulnerable versions 5.4.4 Fixed in 5.4.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-39367 Patch priority Low CVSS severity Low 5.3 Developer EPC PSID 7bef03870816 Credits Ananda Dhakal Patchstack Required privilege...
CVE-2025-32982
NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module...
WakaTime: Broken Access Control Exposes Email Verification Status and Privacy Settings via API Endpoint
The /api/v1/users/username endpoint leaked sensitive email-related metadata, such as the user's email confirmation status and privacy settings, without proper authorization checks. This allowed attackers to determine whether an account's email address was confirmed and the user's email privacy...
WordPress Aeropage Sync for Airtable plugin <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion vulnerability discovered by Cheng Liu in WordPress Plugin Aeropage Sync for Airtable versions = 3.2.0...
