CVE-2026-77171

A public shared collective always allowed recipients of the link to create pages...

CVE-2026-77171

A public shared collective always allowed recipients of the link to create pages...

CVE-2026-77171

The Nextcloud Collectives application is vulnerable to an Improper Access Control issue (CWE-284). The vulnerability allows non-members who access a public collective to create new pages via the backend API , effectively bypassing collective-level permission settings that should restrict editing ...

CVE-2026-77171: Improper Access Control

A public shared collective always allowed recipients of the link to create pages...

CVE-2026-110019

The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-110019: Missing Authorization

The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-14923

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure

Description The plugin does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. e.g. draft, private, pending review, password-protected, and trashed posts. 1. ADMIN: Install Event Tickets 2. ADMIN: Install Event Tickets Plus ...

CVE-2022-23737: Improper Privilege Management

An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This...

GitHub Enterprise Server security vulnerabilities

GitHub Enterprise Server is a U.S. GitHub open source application. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server versions prior to 3.7, which...

Cross site request forgery (csrf)

An issue was discovered in portfolioCMS 1.0.5. There is CSRF to create new pages via admin/portfolio.php?newpage=true...

Gleez CMS Cross-Site Request Forgery Vulnerability

Gleez CMS is an extensible open source content management system CMS based on the Kohana framework. A cross-site request forgery vulnerability exists in Gleez CMS version 1.2.0. A remote attacker can exploit this vulnerability to create new pages and logs...

IBM WebSphere Process Server Access Restriction Bypass Vulnerability

IBM WebSphere Process Server is the business process automation engine. A security vulnerability exists in Business Space in some versions of IBM WebSphere Process Server, which can be exploited by remote attackers to bypass access restrictions and create arbitrary pages or spaces...