joomla-levels-api

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · joomla-levels-api joomla-levels-api Class: Privilege leftover Reach: Remote Joomla CMS 6.1.3 0f2d4de - Open Source Matters Administrator Users - Viewing Access Levels requires core.admin on comusers...

CVE-2026-112845

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus Slidebars off-canvas-sidebars allows Stored XSS.This issue affects Off-Canvas Sidebars & Menus Slidebars: from n/a through 0.5.9...

CVE-2026-112845 WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus Slidebars off-canvas-sidebars allows Stored XSS.This issue affects Off-Canvas Sidebars & Menus Slidebars: from n/a through 0.5.9...

CVE-2026-112845

The WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin, developed by Jory Hogeveen, is vulnerable to a Stored Cross-Site Scripting (XSS) issue in versions 0.5.9 and below . The root cause is the improper neutralization of input during web page generation . This vulnerability allows an attac...

EUVD-2026-108058

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus Slidebars off-canvas-sidebars allows Stored XSS.This issue affects Off-Canvas Sidebars & Menus Slidebars: from n/a through 0.5.9...

WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ihsan Saddan in WordPress Plugin Off-Canvas Sidebars & Menus Slidebars versions = 0.5.9...

CVE-2026-110982

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...

EUVD-2026-107071

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...

PT-2026-120466

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...

CVE-2026-110976

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type,...

EUVD-2026-103398

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type,...

CVE-2026-110215

The youlai-boot application (versions through 2.21.1 ) is vulnerable to a missing authorization flaw in the role menu assignment functionality. Specifically, authenticated users can interact with the PUT /api/v1/roles/{roleId}/menus endpoint to assign arbitrary menu and button permissions to role...

CVE-2026-110215 youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/roleId/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role,...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Vim vulnerabilities (USN-8657-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8657-1 advisory. It was discovered that Vim incorrectly handled memory when decoding certain JSON...

CVE-2026-110215: Missing Authorization

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/roleId/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role,...

coop (4.0.0), wagtail-grapple (>=0.16.1, <=0.17.1) +4 more potentially affected by CVE-2026-55468 via wagtail (4.0.4)

wagtail PYPI version 4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop 4.0.0 - wagtail-grapple =0.16.1, =0.17.1 - wagtail-hallo 0.2.0 - wagtail-nav-menus 3.9.2 - wagtail-streamfield-migration-toolkit 0.1.0 -...

CVE-2026-75927: Improper Privilege Management

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

CVE-2026-81201

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201

The Drupal Monster Menus module (versions 0.0.0 through 9.5.3 ) is vulnerable to a Stored Cross-site Scripting (XSS) issue. The root cause is the module's failure to sufficiently sanitize HTML code within the page name when it is rendered in the built-in tree browser . This allows an attacker, wh...

EUVD-2026-69997

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...