WordPress BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Short URL Creation vulnerability discovered by Wordfence PRISM in WordPress Plugin BetterLinks versions = 3.1.0...

CVE-2026-19801

The BetterLinks WordPress plugin (Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP) is vulnerable to authorization bypass in all versions up to and including 3.1.0 . The root cause is improper verification of user authorization in the create_fbs_link AJAX action, allowing an...

PT-2026-81907

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route report project view export. The authorization guards are attached to the sibling invoke method rather than at the class level, so the export route inherits no authorization checks. Any...

autogpt-CVE-2026-30950-poc

AutoGPT CVE-2026-30950 POC Proof-of-Concept-Demonstration für CVE-2026-30950, eine authentifizierte IDOR Fehlende Autorisierung in der AutoGPT-Plattform, die es jedem angemeldeten Benutzer ermöglicht, die Chat-Sitzung eines anderen Benutzers über eine einzige PATCH-Anfrage neu zuzuweisen — und...

CVE-2025-2907

CVE-2025-2907 Exploit Details Veröffentlicht : 2025-04-04 Aktualisiert : 2025-03-28 Schweregrad : Kritisch CVSS-Score: 9.8 CWE : CWE-862: CWE-862 Fehlende Autorisierung Betroffene Versionen : Alle Versionen von n/a bis 12.3.1 Forscher :...

Sakai Profile Image Deletion has an IDOR

Summary The Sakai REST API endpoint DELETE /api/users/userId/profile/image does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different userId i...

CVE-2025-5815-Nuclei-Template

📄 Template Nuclei per CVE-2025-5815 🚀 Panoramica Questo repository contiene un template Nuclei progettato specificamente per rilevare una vulnerabilità di disabilitazione non autenticata del logging dei bot CVE-2025-5815 nel plugin Traffic Monitor per WordPress. Questo problema consente ad...

CVE-2025-39459-Nuclei-Template

📄 Nuclei-Vorlage für CVE-2025-39459 🚀 Übersicht Dieses Repository enthält eine Nuclei-Vorlage, die speziell entwickelt wurde, um eine nicht authentifizierte Privilegienausweitungsschwachstelle CVE-2025-39459 im Real Estate 7 WordPress Theme zu erkennen. Dieses Problem ermöglicht es nicht...

CVE-2024-7135

CVE-2024-7135 Tainacan = 0.21.7 - प्रमाणित उपयोगकर्ताओं सब्सक्राइबर+ द्वारा आर्बिट्रेरी फ़ाइल रीड के लिए लापता प्राधिकरण विवरण WordPress के लिए Tainacan प्लगइन 0.21.7 तक के सभी संस्करणों में 'getfile' फ़ंक्शन पर क्षमता जाँच की कमी के कारण डेटा के अनधिकृत अभिगम के लिए संवेदनशील है। यह फ़ंक्शन...

CVE-2024-5324

CVE-2024-5324 Login/Signup Popup Inline Form + Woocommerce 2.7.1 - 2.7.2 - Autorizzazione mancante per aggiornamento arbitrario delle opzioni Descrizione: Il plugin Login/Signup Popup Inline Form + Woocommerce per WordPress è vulnerabile a modifiche non autorizzate dei dati a causa di una mancanz...

CVE-2024-43998

CVE-2024-43998 root@kitploit: Blogpoet = 1.0.2 - Missing Authorization via blogpoetinstallandactivateplugins Published: 2024-08-29 00:00:00 Classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N cvss-score: 5.3 cve-id: CVE-2024-43998 cpe: cpe:2.3:a:blogpoet:blogpoet::::::::...

CVE-2024-22145

CVE-2024-22145 InstaWP Connect = 0.1.0.8 - Autorizzazione mancante per aggiornamento arbitrario delle opzioni Subscriber+ Descrizione: Il plugin InstaWP Connect – 1-click WP Staging & Migration per WordPress è vulnerabile a modifiche non autorizzate dei dati a causa di un controllo di capacità...

CVE-2024-11643

CVE-2024-11643 Accessibility by AllAccessible input type="hidden" name="optvalue" value="administrator...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - Fehlende Autorisierung zur Offenlegung sensibler Informationen Beschreibung „Das Popup by Supsystic Plugin für WordPress ist in allen Versionen bis einschließlich 1.10.19 über die getWpCsvList-Aktion anfällig für die Offenlegung sensibler Informatione...

CVE-2025-1307

Exploit Newscrunch CVE-2025-1307 🚨 Panoramica Questo exploit prende di mira una vulnerabilità critica CVE-2025-1307 nel tema WordPress Newscrunch. La falla permette a utenti autenticati di livello Abbonato e superiore di caricare file arbitrari a causa della mancanza di controlli di capacità nell...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection Fehlerhafte Zugriffskontrolle Proof of Concept für eine fehlende Autorisierungsschwachstelle in MISPs Massenlöschungsvorgängen für Event Reports und Sharing Groups. Die deleteSelection-Handler autorisieren jedes ausgewählte Element mit einem Callback, der das...

CVE-2025-5304

CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - Autorizzazione mancante per l'escalation di privilegi non autenticata 🚀 PT Project Notebooks ≤ 1.1.3 — Escalation di privilegi non autenticata CVE-2025-5304 PoC e helper per l'exploit per PT Project Notebooks versioni 1.0.0–1.1.3 : la mancata...

CVE-2026-71933 DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...

EUVD-2026-64992

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...

CVE-2026-71933

DrayTek VigorSwitch (multiple models) is affected by unauthorized operation vulnerabilities in its syslog functions , caused by missing authorization checks . A remote unauthenticated attacker can send crafted requests to modify configuration , restart services , save startup configuration , or c...