CVE-2025-48147 WordPress CryptoCloud - Crypto Payment Gateway plugin <= 2.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crypto Cloud CryptoCloud - Crypto Payment Gateway cryptocloud-crypto-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CryptoCloud - Crypto Payment Gateway: from n/a through = 2.1.2...

CVE-2025-49289

Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through = 5.5.0...

CVE-2025-30957

Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through = 1.1.2...

CVE-2025-30624

CVE-2025-30624 (WordLift) is a Missing Authorization vulnerability in the WordLift WordLift WordPress plugin. The issue stems from incorrectly configured access control security levels. Affected versions are from n/a through 3.54.4. CVSS v3.1 base score is 4.3 (Medium) with vectors AV:N/AC:L/PR:L...

CVE-2025-30945

CVE-2025-30945 — Affected: Taskbuilder (WordPress plugin)

CVE-2025-30978

CVE-2025-30978 : Missing Authorization in the Slack Notifications by dorzki WordPress plugin (versions from n/a to 2.0.7) due to incorrectly configured access control levels. The vulnerability has a CVSS v3.1 base score of 4.3 (Medium) with network attack vector and low privilege/complexity requi...

CVE-2025-49287

CVE-2025-49287 : A Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce affects Product Feed for WooCommerce (Google Shopping Feed, Pinterest Feed, TikTok Ads & More) up to version 2.2.8. The CVSSv3.1 base score is 4.3 (Medium); attack vector is network, with low attack c...

Mattermost Server 9.11.x < 9.11.13 / 10.5.x < 10.5.4 / 10.7.x < 10.7.1 Multiple Vulnerabilities (MMSA-2025-00457, MMSA-2025-00462)

The version of Mattermost Server installed on the remote host is prior to 9.11.13, 10.5.4, or 10.7.1. It is, therefore, affected by multiple vulnerabilities as referenced in the MMSA-2025-00457 and MMSA-2025-00462 advisories. - Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.1...

CVE-2025-5422

A vulnerability, which was classified as problematic, was found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/logs/email of the component Email Logs Page. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The explo...

Unauthorized File Disclosure

mcp-markdownify-server is vulnerable to Unauthorized File Disclosure. The vulnerability is due to improper access control due to the get-markdown-file tool allowing external prompts to read arbitrary files from the host system...

CVE-2025-5425

CVE-2025-5425 affects juzaweb CMS up to 3.4.2. The vulnerability targets the Theme Editor Page component (file /admin-cp/theme/editor/default) and is due to improper access controls in that function, enabling a remote attack. An exploit has been publicly disclosed. The connected documents do not ...

GHSA-86JG-35XJ-3VV5 Mattermost fails to properly enforce access control restrictions for System Manager roles

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team...

CVE-2025-22800

Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through = 2.9.11...

CVE-2024-43136

Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through = 3.2.1...

CVE-2024-20325

A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service on an affected device. This vulnerability is due to insufficient access control implementations o...

CVE-2024-50454

Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through = 8.1.1...

CVE-2024-54408

Cross-Site Request Forgery CSRF vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for-youtube-businesses allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Video Grid: from n/a through = 1.9...

CVE-2024-54384

Missing Authorization vulnerability in Anh Tran Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through = 2.8.3...

CVE-2024-37468

Missing Authorization vulnerability in blazethemes Newsmatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newsmatic: from n/a through 1.3.1...

CVE-2024-55993

Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through = 2.1.61...