Concrete CMS - User Enumeration

Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the "Preview As User" panel concrete/controllers/panel/page/previewasuser.php. id: CVE-2026-18110 info: name: Concrete CMS - User Enumeration author: community severit...

WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

PublishPress Capabilities < 2.3.1 - Missing Authorization

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...

Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure

Arcane 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access id: CVE-2026-42461 info: name: Arcane 1.18.0 - Unauthenticated...

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed...

MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure

MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication. id: CVE-2026-81199 info:...

ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy

The ElementsKit Elementor Addons Lite elementskit-lite plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check CWE-306. The handler accepts client-supplied Mailchimp API credentials and a list paramet...

LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization

LottieFiles LottieFiles = 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges. id: CVE-2025-68043 info: name: LottieFiles WordPress Plugin =...

WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization

WPZOOM Social Icons Widget & Block versions up to 4.2.15 contain a missing authorization vulnerability caused by insufficient access control in the widget and block, letting attackers perform unauthorized actions, exploit requires no special conditions. id: CVE-2024-30464 info: name: WPZOOM Socia...

WordPress RSVP and Event Management <2.7.8 - Missing Authorization

WordPress RSVP and Event Management plugin before 2.7.8 is susceptible to missing authorization. The plugin does not have any authorization checks when exporting its entries, and the export function is hooked to the init action. An attacker can potentially retrieve sensitive information such as...

CVE-2026-109808

The SAP Solution Tools Plug-In is vulnerable to a missing authorization check in certain remote-enabled functionality. An authenticated attacker can invoke this functionality to access restricted data, provided they have prior knowledge of specific internal identifiers. Successful exploitation al...

EUVD-2026-120690

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must ha...

EUVD-2026-120551

Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every...

EUVD-2026-120538

MrDoc through 1.1.1 contains a missing authorization vulnerability in the projectdocsort and manageprojectdocsort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sortdata. Attackers owning any project can reparent and reorder documents...

EUVD-2026-120540

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...

EUVD-2026-120541

PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the applyrecords handler for /admin/template//apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX...

EUVD-2026-120528

DollarDollar through 4.4 contains a missing authorization vulnerability in addexpense that allows authenticated users to modify other users' account balances by supplying foreign accountid values. Attackers can submit sequential accountid, destinationaccountid, and groupid values to /addexpense t...

CVE-2026-125388

The Intermesh Group-Office software, in versions prior to 6.8.181 , 25.0.116 , and 26.0.58 , is vulnerable to a missing authorization flaw in the api/download.php component. This flaw allows authenticated users to bypass permission checks to request the business/forms/report blob using a specific...

CVE-2026-125375

The software MrDoc versions up to and including 1.1.1 is vulnerable to a missing authorization flaw in the project_doc_sort and manage_project_doc_sort handlers. This vulnerability allows registered users to modify documents belonging to other users by providing arbitrary document IDs within the ...

CVE-2026-125377

Pig versions prior to 4.1.2 are susceptible to a missing authorization vulnerability within the SysClientController component. This flaw allows authenticated users lacking specific client-management permissions to retrieve OAuth2 client secrets via the GET /client/{clientId} and GET /client/expor...