405 matches found
PT-2026-146659
Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post id, language id, and created at timestamp to retrieve private unpublished drafts, becau...
CVE-2026-97638
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previousdraftid' parameter due to missing validation on a user controlled key. This makes it...
EUVD-2026-114220
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previousdraftid' parameter due to missing validation on a user controlled key. This makes it...
PT-2026-133724
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous draft id' parameter due to missing validation on a user controlled key. This makes it...
CVE-2026-97638: wpmudev: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure…
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previousdraftid' parameter due to missing validation on a user controlled key. This makes it...
CVE-2026-110507
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft,...
CVE-2026-115624
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...
CVE-2026-115624
The GROWI platform is susceptible to a missing authorization check vulnerability within its collaborative editing feature . This flaw allows users with limited access—such as guest users , users with read-only permissions , or users in pending, suspended, or invited statuses —to bypass intended r...
CVE-2026-115624
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...
CVE-2026-115624
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...
CVE-2026-115624
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...
EUVD-2026-111557
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...
CVE-2026-115624: GROWI, Inc. GROWI: GROWI contains a missing authorization check vulnerability in its collaborative editing feature
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...
PT-2026-127728
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...
GROWI Labs GROWI authorization issue vulnerability
Growi Labs versions GROWI v7.0.0 through v8.0.6 contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks in the collaborative editing functionality, potentially allowing users with read-only permissions—including guest users—or users in pending,...
10up Distributor authorization issue vulnerability
The 10up Distributor versions prior to 2.3.2 have an authorization issue vulnerability. This vulnerability stems from the lack of authorization verification in the ajaxpush function. It allows contributor-level multi-site users to use dt-push nonce along with the selected connection ID and...
CVE-2026-93365
Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...
CVE-2026-93365 Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint
Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...
EUVD-2026-87209
Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...
CVE-2026-93365 Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint
Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...