CVE-2026-92978 User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...

CVE-2026-92978

The User Registration & Membership plugin for WordPress (versions up to and including 5.2.8 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is missing or incorrect nonce validation on the trigger_bulk_action() function. Specifically, an attacker can bypass nonce chec...

CVE-2026-94258

The SMS Alert WordPress plugin versions 3.6.4 through 4.0.0 contains a vulnerability where it fails to verify if an acting administrator has permission to manage specific users before returning their stored billing phone numbers. This flaw allows an administrator of one site on a multisite networ...

CVE-2026-55643 Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...

EUVD-2023-40606

Malicious code in bioql PyPI...

CVE-2023-36662

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24...

CVE-2023-36662

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24...

CVE-2023-36662

The CVE-2023-36662 entry concerns the TechTime User Management components for Atlassian products, which allow stored XSS on the Bulk User Actions page. Affected are: Jira User Management 2.0.0–2.17.1; Confluence User Management 2.0.0–2.15.24; Bitbucket User Management 2.2.2–2.15.24. Root cause: s...

CVE-2023-36662: Improper Neutralization of Input During Web Page Generation

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24...

CVE-2023-36662

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24...

PT-2023-25665 · Atlassian · User Management For Bitbucket +2

Name of the Vulnerable Software and Affected Versions: User Management for Jira versions 2.0.0 through 2.17.1 User Management for Confluence versions 2.0.0 through 2.15.24 User Management for Bitbucket versions 2.2.2 through 2.15.24 Description: The TechTime User Management components for Atlassi...