CVE-2023-6327 ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products

The ShopLentor formerly WooLentor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchasednewproducts function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to view all products purchas...

CVE-2023-6327

ShopLentor (WooLentor) for WordPress is vulnerable to unauthorized data access due to a missing capability check in the purchased_new_products function, affecting all versions up to 2.8.7. This could let unauthenticated attackers view past-week purchases and purchaser data. The CVE entry is shown...

alpitronic Hypercharger EV charger

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: alpitronic Equipment: Hypercharger EV charger Vulnerability: Use of Default Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker disabling...

PT-2024-26306 · Lunar · Lunar

Name of the Vulnerable Software and Affected Versions: Lunar software versions 6.0.2 through 6.6.0 Description: The issue is related to improper privilege management in the Lunar software, allowing an attacker to perform a secondary process injection into the application. This can lead to the abu...

CVE-2024-2860: Missing Authentication for Critical Function

The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where the Brocade SANnav is installed can gain access to sensitive data inside the PostgreSQL database...

lunary information disclosure vulnerability (CNVD-2025-12115)

lunary is a production toolkit for LLM. lunary suffers from an information disclosure vulnerability that stems from inadequate validation of user permissions when joining the organization. An attacker could use this vulnerability to read and modify all data within the organization...

WordPress plugin ClickCease Click Fraud Protection 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2023-32871

In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08355514; Issue ID: ALPS08355514...

MediaTek 芯片 安全漏洞

MediaTek chips are a variety of chips from MediaTek, a Chinese company MediaTek. A security vulnerability exists in the MediaTek chips, which stems from an incorrect state checking issue in the DA module, which may allow privilege bypass...

MOXA NPort 5100A 安全漏洞

MOXA NPort 5100A is a general-purpose device networking server from MOXA, China. A cross-site scripting vulnerability exists in the MOXA NPort 5100A v1.6 and earlier firmware versions, which originates from failure to properly neutralize user-controllable inputs before placing them in the output,...

PT-2024-19704 · Open Xchange Gmbh +1 · Ox App Suite +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the user's browser session. Common user...

CVE-2024-30973

An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitive information via crafted POST request to /boaform/getASPdata/formFirewall, /boaform/getASPdata/formAcc...

Open-Xchange App Suite 安全漏洞

Open-Xchange App Suite is an email and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange App Suite version 8.21 and prior versions, which stems from the presence of a cross-site scripting XSS vulnerability that could allow an attacker to...

The vulnerability of the PowerPanel Business’s monitoring and control system regarding authentication procedures allows unauthorized access by intruders to protected information.

The vulnerability of the PowerPanel Business monitoring and power source management system is related to deficiencies in authentication procedures, due to the absence of blocking mechanisms for substitution signs. Exploiting this vulnerability could allow an attacker operating remotely to gain...

CVE-2023-23474

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 245403...

CVE-2024-3480

An Implicit intent vulnerability was reported in the Motorola framework that could allow an attacker to read telephony-related data...

Vulnerabilities fixed in pgAdmin

Vulnerabilities have been fixed in pgAdmin. A malicious party could exploit the vulnerabilities to bypass any set two-factor authentication in order to bypass it and gain easier access gain access to the system, or to launch a Cross-Site-Scripting XSS attack. attack. Such an attack can lead to...

CVE-2024-1688

The Woo Total Sales plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getordersarchive function in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to retrieve sales reports for the store...

CVE-2024-3601

The CVE-2024-3601 entry for Poll Maker – Best WordPress Poll Plugin (up to v5.1.8) has concrete details in connected docs: a missing capability check in the ays_poll_create_author function allows unauthenticated attackers to enumerate email addresses. Impact is unauthorized data access; attack is...

CVE-2023-6731 WP Show Posts <= 1.1.5 - Improper Authorization to Information Exposure

The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with subscriber access and above, to view arbitrary pos...