8 matches found
CVE-2026-11454 Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/ REST endpoint. The endpoint's permission callback checks only the role-level...
CVE-2026-11454
The Groundhogg WordPress plugin (versions <= 4.5.2) is affected by an Insecure Direct Object Reference via GET /wp-json/gh/v4/contacts/. The endpoint’s permission callback only checks a role-level view_contacts capability, and read_single() returns full contact records without object-level own...
CVE-2026-38532
A Broken Object-Level Authorization BOLA in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request...
EUVD-2011-0757
Malware in sbrugna...
EUVD-2015-5869
Malware in sbrugna...
CVE-2025-24146
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. Deleting a conversation in Messages may expose user contact information in system logging...
PT-2020-11766
Name of the Vulnerable Software and Affected Versions Android versions Android-8.0 through Android-11 Description The issue is related to a permission bypass in SystemUI due to an unsafe PendingIntent, potentially leading to local information disclosure of contact data. This requires User executi...
CVE-2011-4276: Exposure of Sensitive Information to an Unauthorized Actor
The Bluetooth service com/android/phone/BluetoothHeadsetService.java in Android 2.3 before 2.3.6 allows remote attackers within Bluetooth range to obtain contact data via an AT phonebook transfer...