PT-2026-126340

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced...

Linux Distros Unpatched Vulnerability : CVE-2026-115373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/uuid that lets...

WordPress Advanced Custom Fields: Extended plugin <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure vulnerability

Missing Authorization to Unauthenticated Data Exposure vulnerability discovered by Jay in WordPress Plugin ACF Extended versions = 0.9.2.7...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

CVE-2025-30772

🚨 CVE-2025-30772 - Privilege Escalation in WPC Smart Upsell Funnel for WooCommerce 📅 Published: March 27, 2025 🔐 CVSS Score: 8.8 High 🔥 CWE-862: Missing Authorization 🐞 Vulnerability Summary A Missing Authorization vulnerability in the WPC Smart Upsell Funnel for WooCommerce plugin allows...

CVE-2026-116809 OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types,...

CVE-2026-116810 OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant...

CVE-2026-116810

OpenPanel versions prior to 3.0.0 are affected by a missing authorization vulnerability in the public reference.getChartReferences tRPC procedure. This flaw allows unauthenticated attackers to read annotations from any project by using guessable slug-based project IDs. Impacted data includes cros...

CVE-2026-116809

OpenPanel versions before 3.0.0 are vulnerable to a missing authorization flaw in the event.bots tRPC procedure. The vulnerability occurs because the system only checks for the existence of a shareOverview row rather than properly authenticating the request. This allows unauthenticated attackers ...

CVE-2026-116809 OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types,...

CVE-2026-116809 OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types,...

CVE-2026-116810 OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant...

CVE-2024-12172

CVE-2024-12172 WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses = 3.2.21 - Missing Authorization to Authenticated Subscriber+ Arbitrary User Meta Update Description The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution,...

CVE-2026-116746

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed reviewajaxtoken and enumerate sequential idorder...

CVE-2026-116746 QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed reviewajaxtoken and enumerate sequential idorder...

CVE-2026-116746 QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed reviewajaxtoken and enumerate sequential idorder...

CVE-2026-116746

The QloApps platform (versions 1.6.0 through 1.7.0 ) contains a missing authorization vulnerability within the qlohotelreview module's AddReview AJAX action . This flaw allows unauthenticated attackers to submit fake ratings and reviews for arbitrary orders. The attack vector involves reusing a p...

CVE-2026-116746 QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed reviewajaxtoken and enumerate sequential idorder...

wp-ulike-cve-2025-32259-poc

WP ULike ≤ 4.7.9.1 - Unauthenticated Content Spoof CVE-2025-32259 🔬 A simple PoC demonstrating CVE-2025-32259 in the WP ULike plugin for WordPress. 🚨 Educational use only – do not test on systems without explicit authorization. 🧠 Overview WP ULike is a popular WordPress plugin that allows users t...

Burp_CVE-2025-31324

CVE-2025-31324 Burp Suite Extension Overview This Python-based Burp Suite extension is designed to detect the presence of CVE-2025-31324 , a critical vulnerability in SAP NetWeaver Visual Composer’s Metadata Uploader component. The vulnerability allows unauthenticated remote code execution via fi...