CVE-2022-4937

CVE-2022-4937 affects the WCFM Frontend Manager plugin for WordPress. The root cause is missing capability checks on numerous AJAX actions, enabling authenticated users with minimal privileges (e.g., subscribers) to modify data across knowledge bases, notices, payments, vendors, and more. The iss...

PT-2023-15921 · WordPress · Wcfm Marketplace

Name of the Vulnerable Software and Affected Versions: WCFM Marketplace plugin for WordPress versions up to, and including, 3.4.11 Description: The issue allows authenticated attackers with minimal permissions to perform various actions, including modifying shipping method details, modifying...

CVE-2020-36670

The NEX-Forms. plugin for WordPress is vulnerable to unauthorized disclosure and modification of data in versions up to, and including 7.7.1 due to missing capability checks on several AJAX actions. This makes it possible for authenticated attackers with subscriber level permissions and above to...

Design/Logic Flaw

The NEX-Forms. plugin for WordPress is vulnerable to unauthorized disclosure and modification of data in versions up to, and including 7.7.1 due to missing capability checks on several AJAX actions. This makes it possible for authenticated attackers with subscriber level permissions and above to...

CVE-2020-36667

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability checking on the backupguardclouddropbox, backupguardcloudgdrive, and backupguardcloudoneDrive function...

CVE-2020-36668

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backupguardgetmanualmodal function called via an AJAX action. This makes it possible for...

GHSA-2WMJ-8MQG-R9Q8 Moodle has Incorrect Default Permissions

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

Moodle has Incorrect Default Permissions

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

GHSA-35WF-3WQ2-R3HX Moodle has Incorrect Default Permissions

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions...

PT-2023-11835 · WordPress · Jetbackup

Name of the Vulnerable Software and Affected Versions: JetBackup – WP Backup, Migrate & Restore plugin for WordPress versions up to, and including, 1.4.0 Description: The issue is related to sensitive information disclosure due to a lack of proper capability checking on the backup guard get manua...

CVE-2021-36400

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions...

CVE-2021-36400

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions...

CVE-2021-36397

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

CVE-2021-36397

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

Design/Logic Flaw

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

UBUNTU-CVE-2021-36400

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions...

CVE-2021-36397

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

CVE-2021-36400

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions...

CVE-2021-36397

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

CVE-2021-36400

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions...