CVE-2021-47742 Epic Games Psyonix Rocket League <=1.95 Elevation of Privileges via Insecure Permissions

Epic Games Psyonix Rocket League =1.95 contains an insecure permissions vulnerability that allows authenticated users to modify executable files with full access permissions. Attackers can leverage the 'F' Full flag for the 'Authenticated Users' group to change executable files and potentially...

CVE-2021-47742 Epic Games Psyonix Rocket League <=1.95 Elevation of Privileges via Insecure Permissions

Epic Games Psyonix Rocket League =1.95 contains an insecure permissions vulnerability that allows authenticated users to modify executable files with full access permissions. Attackers can leverage the 'F' Full flag for the 'Authenticated Users' group to change executable files and potentially...

CVE-2021-47742

CVE-2021-47742 affects Epic Games Psyonix Rocket League

CVE-2025-49352 WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/...

CVE-2025-49352

Technical details for CVE-2025-49352 are not publicly provided in the supplied documents. No confirmed affected product, root cause, impact, or fix is available here. Monitor for official updates from CVE/NVD feeds and vendor advisories.

WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by powpy in WordPress Plugin Order Cancellation & Returns for WooCommerce versions = 1.1.11...

CVE-2025-49334

CVE-2025-49334 affects MyD Delivery (

CVE-2025-49334 WordPress MyD Delivery plugin <= 1.3.7 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through 1.3.7...

WordPress MyD Delivery plugin <= 1.4.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by powpy in WordPress Plugin MyD Delivery versions = 1.4.3...

CVE-2025-63053

CVE-2025-63053 affects Master Addons For Elementor – White Label, Free Widgets, Hover Effects, Conditions, & Animations. The issue is an Unauthenticated Insecure Direct Object Reference (IDOR) due to misconfigured access control, impacting Master Addons For Elementor versions up to 2.0.9.9.4. Wor...

CVE-2025-63053 WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Master Addons for Elementor: from n/a through = 2.0.9.9.4...

CVE-2025-56332

Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration...

CVE-2025-66723

inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths...

PT-2025-54423

Name of the Vulnerable Software and Affected Versions Rocket League versions 1.95 and earlier Description The software contains an insecure permissions issue. Authenticated users can modify executable files with full access permissions. An attacker could exploit this to change executable files an...

The vulnerability of the Mailgen.generatePlaintext(email) method in the Mailgen package of the Node.js software platform allows a attacker to execute arbitrary HTML code.

The vulnerability of the Mailgen.generatePlaintextemail method in the Mailgen package of the Node.js software platform is related to the lack of security measures for handling web page structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML code remotely...

WordPress WP Job Portal plugin <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion vulnerability

Insecure Direct Object Reference to Authenticated Employer+ Arbitrary Job Deletion vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin WP Job Portal versions = 2.2.6...

CVE-2021-47742: Incorrect Permission Assignment for Critical Resource

Epic Games Psyonix Rocket League =1.95 contains an insecure permissions vulnerability that allows authenticated users to modify executable files with full access permissions. Attackers can leverage the 'F' Full flag for the 'Authenticated Users' group to change executable files and potentially...

PT-2025-54469

Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.22.0 Description RAGFlow is a Retrieval-Augmented Generation engine. Versions prior to 0.22.0 utilize an insecure key generation algorithm when creating API keys and beta tokens assistant/agent share auth. This allo...

RAGFlow 安全漏洞

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A security vulnerability exists in RAGFlow versions prior to 0.22.0 that stems from the use of insecure key generation algorithms during API key and beta token generation, which could lead to...

EulerOS Virtualization 2.13.0 : curl (EulerOS-SA-2025-2607)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : 1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target...