12527 matches found
CVE-2025-3915
The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aeropageDeletePost' function in all versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2025-3906
CVE-2025-3906 (Integração entre Eduzz e Woocommerce, WordPress) describes a Missing Authorization vulnerability across all versions up to 1.7.5. The issue arises from a missing capability check in the wep_opcoes function, enabling authenticated attackers with Subscriber+ privileges to modify data...
CVE-2025-3906 Integração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wepopcoes' function in all versions up to, and including, 1.7.5. This makes it possible for authenticated attackers, with Subscriber-level...
CVE-2024-10680
The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2025-17952 · WordPress · Aeropage Sync For Airtable
Name of the Vulnerable Software and Affected Versions: Aeropage Sync for Airtable plugin for WordPress versions up to, and including, 3.2.0 Description: The issue is related to unauthorized loss of data due to a missing capability check on the aeropageDeletePost function. This allows authenticate...
PT-2025-17950 · WordPress · Integração Entre Eduzz E Woocommerce
Name of the Vulnerable Software and Affected Versions: Integração entre Eduzz e Woocommerce plugin for WordPress versions up to, and including, 1.7.5 Description: The issue is related to a missing capability check on the wep opcoes function, allowing authenticated attackers with Subscriber-level...
WordPress plugin: Security vulnerabilities in integration between Eduzz and Woocommerce
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...
WordPress plugin Aeropage Sync for Airtable has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
CVE-2025-3906: Missing Authorization
The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wepopcoes' function in all versions up to, and including, 1.7.5. This makes it possible for authenticated attackers, with Subscriber-level...
Moodle has an IDOR in messaging web service which allows access to some user details
A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses...
Authorization Bypass Through User-Controlled Key
Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to insufficient capability checks in the web service. An attacker can access sensitive user details such as full names and profile images by...
GHSA-6G5X-H5X7-Q4MQ Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users
A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access...
Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users
A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access...
GHSA-CHMF-M33P-PH8M Moodle allows IDOR in RSS block, which allows access to additional RSS feeds
A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks...
Missing Authorization
Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Missing Authorization due to insufficient capability checks in certain grade reports. An attacker can view hidden grades by accessing these reports without the required permissions. Remediation...
CVE-2025-3645
A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses...
CVE-2025-3636
A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks...
CVE-2025-32045
A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades...