CVE-2025-13496

CVE-2025-13496 (Moosend Landing Pages, WordPress) The WordPress plugin Moosend Landing Pages (up to v1.1.6) contains a missing capability check in moosend_landings_auth_get, allowing authenticated users with Subscriber level access or higher to delete the moosend_landing_api_key option. The issue...

CVE-2025-12113

CVE-2025-12113 affects the WordPress plugin “Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images” (versions

CVE-2025-3580

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator...

CVE-2025-3580: Improper Access Control

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator...

CVE-2025-3964

A vulnerability, which was classified as problematic, was found in withstars Books-Management-System 1.0. Affected is an unknown function of the file /api/article/del of the component Article Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the delete API. An attacker can execute arbitrary JavaScript code by injecting malicious scripts into user inputs. This can lead to unauthorized actions such as stealing session cookies, redirecting to...

PT-2025-11237

Name of the Vulnerable Software and Affected Versions: The Resido - Real Estate WordPress Theme versions up to, and including, 3.6 Description: The issue is related to unauthorized access due to a missing capability check on the delete api key and save api key AJAX actions. This allows...

CVE-2024-55954

OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint "/api/orgid/users/emailid" allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the...

PT-2025-3162

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 0.14.1 Description A vulnerability in the user management endpoint /api/org id/users/email id allows an "Admin" role user to remove a "Root" user from the organization, violating the intended privilege hierarchy...

Privilege Escalation

github.com/usememos/memos is vulnerable to privilege escalation. An authenticated user is able to delete all notes of the whole application via the DELETE API...

CVE-2022-31884: Undefined Security Weakness

Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including high privilege and the Administrator users API Keys...