CVE-2026-4290 WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators

The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/userid REST API endpoint in all versions up to, and including, 10.6.0. This is due to the checkpermission callback unconditionally returning true and the Database::delete...

PT-2025-6520

Name of the Vulnerable Software and Affected Versions WP Abstracts plugin for WordPress versions up to, and including, 2.7.3 Description The issue is due to missing nonce validation on multiple functions, making it possible for unauthenticated attackers to delete arbitrary accounts via a forged...

CVE-2011-0437

shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control DTC before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edsshaccount parameter in a deletesshaccount Delete action...

CVE-2011-0437: Undefined Security Weakness

shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control DTC before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edsshaccount parameter in a deletesshaccount Delete action...

PT-2011-1059

Name of the Vulnerable Software and Affected Versions Domain Technologie Control DTC versions prior to 0.32.9 Description The issue concerns multiple vulnerabilities in the DTC package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality,...

Code injection

Butterfly Organizer 2.0.0 allows remote attackers to 1 delete arbitrary categories via a modified tablehere parameter to category-delete.php with the isjsconfirmed parameter set to 1, or 2 delete arbitrary accounts via the mytable parameter to delete.php...

CVE-2009-2328: Improper Authentication

admin/edituser.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the deluserid parameter...