PT-2026-46328

Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...

CVE-2026-41658

CVE-2026-41658 (Admidio) describes missing authorization in the inventory module: destructive endpoints (item_delete, item_retire, item_reinstate, item_picture_upload/save/delete) validate CSRF but perform no backend authorization checks, allowing any authenticated user with inventoryModule acces...

Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items

Summary The Admidio inventory module enforces authorization for destructive operations delete, retire, reinstate only in the UI layer by conditionally rendering buttons. The backend POST handlers at modules/inventory.php for itemdelete, itemretire, itemreinstate, itempictureupload, itempicturesav...

CVE-2025-12777 YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugin not properly verifying that a user is authorized to perform actions on the REST API /wp-json/yith/wishlist/v1/lists endpoint which uses...

PT-2025-3151

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 11.5.42 ELTS TYPO3 versions prior to 12.4.25 LTS TYPO3 versions prior to 13.4.3 LTS Description A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptible ...

CVE-2023-4318: Undefined Security Weakness

The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers to make logged in admins delete arbitrary effects via a CSRF attack...

Sql injection

Code-projects Online Restaurant Management System 1.0 is vulnerable to SQL Injection. Through SQL injection, an attacker can bypass the admin panel and view order records, add items, delete items etc...

CVE-2023-37627: Improper Neutralization of Special Elements used in an SQL Command

Code-projects Online Restaurant Management System 1.0 is vulnerable to SQL Injection. Through SQL injection, an attacker can bypass the admin panel and view order records, add items, delete items etc...

CVE-2021-44321: Cross-Site Request Forgery (CSRF)

Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery CSRF, where an attacker can update/delete items in the inventory. The attacker must be logged into the application create a malicious file for updating the inventory details and items...

CVE-2021-25072: Cross-Site Request Forgery (CSRF)

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack...

PT-2020-2849 · Microsoft · Sharepoint Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: A cross-site-scripting XSS issue exists due to improper sanitization of specially crafted web requests. An authenticated attacker could exploit this by sending a special...

TeamPass items.series.php Access Control Vulnerability

TeamPass is a dedicated password manager for Apache, MySQL and PHP. An access control vulnerability exists in versions prior to TeamPass 2.1.27.9 that stems from the program failing to properly enforce item access control. An attacker can exploit the vulnerability by tampering with requests to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users...

CVE-2008-0272: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users...