201817 matches found
EUVD-2026-50115
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
CVE-2025-10656
CVE-2025-10656 affects the WordPress plugin “Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light” up to version 2.4.37. The root cause is a Missing Authorization in the user_filter function, allowing unauthenticated attackers to create admin accounts, enabling privilege escalation...
CVE-2026-13423
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
CVE-2026-13423
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
CVE-2026-13423
The CVE-2026-13423 vulnerability affects the Streamit WordPress theme up to version 4.5.0. Affected component: the unauthenticated AJAX route that performs no authorization or nonce verification. Root cause: an attacker-supplied PHP function is invoked with attacker-supplied arguments, allowing a...
CVE-2026-12144
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...
CVE-2026-12144 Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...
CVE-2026-12144
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...
CVE-2026-12144
CVE-2026-12144 affects the Wholesale for WooCommerce plugin for WordPress (all versions up to and including 2.0.5). The root cause is in save_requests_meta(): the user_role_set POST parameter is sanitized only with sanitize_text_field(), then passed directly to WP_User::add_role() without an allo...
EUVD-2026-50097
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...
The vulnerability of the MmMapIoSpace() function in the ThrottleBlood.sys driver allows a hacker to escalate their privileges, execute arbitrary code, or cause a service failure.
The vulnerability of the MmMapIoSpace function in the ThrottleBlood.sys driver, as part of the ThrottleStop utility, is related to open IOCTLs with insufficient access control. Exploiting this vulnerability could allow an attacker to enhance their privileges, execute arbitrary code, or cause...
The vulnerability of the Kerberos protocol for Windows operating systems allows attackers to increase their privileges.
The vulnerability of the Kerberos protocol for Windows operating systems is related to errors in the mechanism for handling relative pathnames to the directory. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...
PT-2026-65691
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
firefox: thunderbird: Privilege escalation in WebExtensions
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in WebExtensions...
firefox: thunderbird: Privilege escalation in the DOM: Navigation component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Navigation component...
firefox: thunderbird: Privilege escalation in the DOM: Content Processes component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Content Processes component...
EUVD-2026-50064
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...
CVE-2026-14446
IBM WebSphere Application Server 9.0 and 8.5 are reported vulnerable to broken access control/privilege escalation in the administrative console. The CVSSv3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a base score of 9.8 (CRITICAL). Impact relates to confidentiality, integrity, and avai...
CVE-2026-50736
The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party actin...
CVE-2026-48390
Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Sco...