CVE-2025-3921 PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handelajaxreq function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user's metadata whic...

PT-2025-20280 · Cisco · Cisco Catalyst Center

Name of the Vulnerable Software and Affected Versions: Cisco Catalyst Center versions affected versions not specified Description: A vulnerability could allow an authenticated, remote attacker to read and modify data in a repository that belongs to an internal service of an affected device. This...

Cisco Catalyst Center 访问控制错误漏洞

Cisco Catalyst Center Cisco DNA Center is a network management system from Cisco USA. An access control error vulnerability exists in Cisco Catalyst Center that stems from insufficient access control and could lead to data read and modify attacks...

PT-2025-19911 · WordPress · Peprodev Ultimate Profile Solutions

Name of the Vulnerable Software and Affected Versions: PeproDev Ultimate Profile Solutions plugin for WordPress versions 1.9.1 through 7.5.2 Description: The issue allows unauthorized modification of data due to a missing capability check on the handel ajax req function. This enables...

CVE-2025-0856

The CVE (CVE-2025-0856) concerns the WordPress PGS Core plugin and is caused by a missing capability check in multiple functions, affecting all versions up to and including 5.8.0. This permits unauthenticated attackers to access, modify, or delete plugin options, effectively enabling unauthorized...

CVE-2025-0856 PGS Core <= 5.8.0 - Missing Authorization via Multiple Functions

The PGS Core plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.8.0. This makes it possible for unauthenticated attackers to add, modify, or plugin options...

The vulnerability of the PCMan FTP Server relates to the occurrence of operations beyond the buffer boundaries in memory. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the PCMan FTP Server relates to the execution of operations beyond the buffer boundaries during the processing of the RMD parameter. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain access to read, modify, add, or delete data, or to cause a service failure.

The vulnerability of the Core component of the Oracle VM VirtualBox software lies in insufficient validation of input data. Exploiting this vulnerability can allow an attacker to read, modify, add, or delete data, or cause a service failure...

CVE-2025-3952

The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'ptoremovelogo' function in all versions up to, and including, 5.1.16. This makes it possible for...

CVE-2025-1326

The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homeyreservationdel function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

CVE-2025-1326

CVE-2025-1326 affects the Homey WordPress theme (versions up to 2.4.4). Root cause: missing capability check in the function homey_reservation_del(), enabling authenticated attackers with Subscriber-level access and above to delete arbitrary reservations and posts. Impact: unauthorized modificati...

WordPress plugin Homey 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-3452

The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'secupressreinstallpluginsadminajaxcb' function in all versions up to, and including, 2.3.9. This makes it possible for authenticated attackers,...

CVE-2025-3952

The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'ptoremovelogo' function in all versions up to, and including, 5.1.16. This makes it possible for...

CVE-2025-3952 Projectopia &#8211; WordPress Project Management <= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion

The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'ptoremovelogo' function in all versions up to, and including, 5.1.16. This makes it possible for...

CVE-2025-3952 Projectopia &#8211; WordPress Project Management <= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion

The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'ptoremovelogo' function in all versions up to, and including, 5.1.16. This makes it possible for...

CVE-2025-2816

The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the yellowmessagedontshow function in versions 2.8.0 to 2.8.4. This makes it possible for authenticated attackers, with...

CVE-2025-2816

CVE-2025-2816 involves the WordPress Page View Count plugin (versions 2.8.0–2.8.4) where a missing capability check in the yellow_message_dontshow() function allows authenticated attackers with Subscriber-level access or higher to modify options, potentially causing a denial of service by updatin...

PT-2025-18351 · WordPress · Page View Count

Name of the Vulnerable Software and Affected Versions: Page View Count plugin for WordPress versions 2.8.0 through 2.8.4 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data due to a missing capability check on the yellow message dontshow...

PT-2025-18358 · WordPress · Projectopia

Name of the Vulnerable Software and Affected Versions: The Projectopia – WordPress Project Management plugin for WordPress versions up to, and including, 5.1.16 Description: The issue allows unauthorized modification of data, potentially leading to a denial of service. This is due to a missing...