CVE-2025-23955

CVE-2025-23955 affects the Xola WordPress plugin (Xola: Booking for WordPress and Tours) up to version 1.6. It is described as a Missing Authorization vulnerability with broken access control, enabling unauthorized access to certain resources. The CVSS 3.1 vector from Patchstack indicates: AV:N, ...

CVE-2025-23955 WordPress Xola plugin <= 1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in xola Xola xola-bookings-for-tours-activities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xola: from n/a through = 1.6...

CVE-2025-23963

CVE-2025-23963 is a Missing Authorization vulnerability affecting Mark Posts (WordPress plugin) versions up to 2.2.3. The initial description notes exploitation of incorrectly configured access control security levels. CVSSv3.1 base score is 5.4 (Medium). Public details in connected Red Hat entry...

CVE-2025-23954 WordPress Salvador – AI Image Generator plugin <= 1.0.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in awcode Salvador – AI Image Generator salvador-ai-image-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salvador – AI Image Generator: from n/a through = 1.0.11...

CVE-2025-23930 WordPress PayPal Marketing Solutions plugin <= 1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in paypalmuse PayPal Marketing Solutions paypal-promotions-and-insights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Marketing Solutions: from n/a through = 1.2...

CVE-2025-23929

CVE-2025-23929 affects the WordPress plugin Email Capture & Lead Generation by WishfulThemes. The connected Red Hat entry repeats a Missing Authorization vulnerability caused by incorrectly configured access control , impacting versions listed as “from n/a through 1.0.2.” The CVSS data in the ini...

CVE-2025-23929 WordPress Email Capture & Lead Generation Plugin <= 1.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in wishfulthemes Email Capture & Lead Generation email-capture-lead-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email Capture & Lead Generation: from n/a through = 1.0.2...

CVE-2025-23862 WordPress Contact Form 7 Anti Spambot plugin <= 1.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in SzMake Contact Form 7 Anti Spambot contact-form-7-anti-spambot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 Anti Spambot: from n/a through = 1.0.1...

CVE-2025-23785 WordPress AI Responsive Gallery Album plugin <= 1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in August Infotech AI Responsive Gallery Album ai-responsive-gallery-album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Responsive Gallery Album: from n/a through = 1.4...

CVE-2025-23785

Technical details for CVE-2025-23785 are not provided in the supplied documents; there is no listed root cause, affected versions, exploitation details, or remediation.

CVE-2025-23778 WordPress User Sync ActiveCampaign plugin <= 1.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Pravin Durugkar User Sync ActiveCampaign registered-user-sync-activecampaign allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Sync ActiveCampaign: from n/a through = 1.3.2...

CVE-2025-23423 WordPress SendGrid for WordPress plugin <= 1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Smackcoders SendGrid for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SendGrid for WordPress: from n/a through 1.4...

D-Link DIR-816 A2 /goform/form2LocalAclEditcfg.cgi Access Control Error Vulnerability

The D-Link DIR-816 A2 is a wireless router from China's AUO D-Link. An access control error vulnerability exists in D-Link DIR-816 A2 version 1.10CNB05R1B011D88210, which stems from improper access control in /goform/form2LocalAclEditcfg.cgi. An attacker can exploit this vulnerability to be able ...

CVE-2024-57681

An access control issue in the component form2alg.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request...

CVE-2025-22773

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Htaccess File Editor: from n/a through = 1.0.19...

CVE-2025-22729 WordPress VOD Infomaniak plugin <= 1.5.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Infomaniak Staff VOD Infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VOD Infomaniak: from n/a through 1.5.9...

CVE-2025-22779

CVE-2025-22779 : Missing Authorization vulnerability in the WordPress plugin WP News Sliders (by Ugur CELIK) due to incorrectly configured access control. Affected: WP News Sliders versions up to 1.0 (reported as n/a through 1.0). CVSS 3.1. Privileges Required: Low; Attack Vector: Network; Impact...

CVE-2025-22787 WordPress Button Block plugin <= 1.1.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through = 1.1.5...

huawei HarmonyOS Privilege Permission and Access Control Issues Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a cross-process page stacking vulnerability in UIExtension. An attacker could exploit t...

NEC Aterm多款产品 访问控制错误漏洞

The NEC Aterm WF1200C and others are a wireless router from Nippon Electric NEC. An access control error vulnerability exists in various NEC Aterm products that stems from a lack of authentication for critical functions, allowing an attacker to obtain Wi-Fi passwords over the Internet. The...