78 matches found
CVE-2025-9049 Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...
PT-2026-86405
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri account member permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...
grafana security update
9.2.10-33.0.1 - Fixes CVE-2024-1442 Add email verification when updating user email Orabug: 38550520 9.2.10-33 - Rebuild against updated golang - Resolves RHEL-251835 - Resolves RHEL-251696 - Resolves RHEL-242383 - Resolves RHEL-242344 - Resolves RHEL-242224 - Resolves RHEL-242108 - Resolves...
CVE-2026-44584: Insufficient Verification of Data Authenticity
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified statu...
CVE-2026-7655
The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...
PT-2026-57403
Name of the Vulnerable Software and Affected Versions SureCart versions prior to 4.2.4 Description An issue exists that allows privilege escalation via account takeover. The software fails to properly validate a user's identity when updating details, such as the email address, during customer...
CVE-2026-7655: Weak Password Recovery Mechanism for Forgotten Password
The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...
PYSEC-2026-1497 kiwi TCMS has possibility for user to update email address to unverified one
Impact In previous versions of Kiwi TCMS users were able to update their email addresses via the "My profile" admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Patches With Kiwi TC...
kiwi TCMS has possibility for user to update email address to unverified one
ImpactIn previous versions of Kiwi TCMS users were able to update their email addresses via the "My profile" admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. PatchesWith Kiwi TCMS...
GHSA-J7F5-GFQM-PCX3 Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
Summary An unprotected user enumeration vulnerability exists in the account email update endpoint, allowing authenticated users to verify whether email addresses are registered on the panel through automated requests without rate limiting or CAPTCHA protection. Details The account settings page...
GHSA-RV89-WCH8-C574 Paymenter doesn't reset email verification status after email change
Summary The email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified status after switching to an unverified or unowned email address. Technical Details When a user updated their emai...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication in the email update process. An attacker can retain a verified status on an account after changing the associated email address to one they do not control by updating the email without triggering a new verificati...
CVE-2026-35407: Improper Authorization
Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given...
CVE-2025-15096
The 'Videospirecore Theme Plugin' plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for...
CVE-2025-15096: Authorization Bypass Through User-Controlled Key
The 'Videospirecore Theme Plugin' plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for...
PT-2026-7512
Name of the Vulnerable Software and Affected Versions Videospirecore Theme Plugin versions prior to 1.0.7 Description The 'Videospirecore Theme Plugin' for WordPress is susceptible to privilege escalation, potentially leading to account takeover. The issue arises from insufficient validation of a...
WordPress WP JobHunt plugin <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover vulnerability
Unauthenticated Privilege Escalation via Email Update/Account Takeover vulnerability discovered by Tonn in WordPress Plugin WP JobHunt versions = 7.1...
CVE-2025-6574: Authorization Bypass Through User-Controlled Key
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for...
