CVE-2023-32117

CVE-2023-32117 Integrate Google Drive ","username":"admin","name":"admin","email":"[email protected]","role":"Administrator","folders":,"id":2,"avatar":"img alt='' src="http:///%5C/%5C/2.gravatar.com%5C/avatar%5C/b58996c504c5638798eb6b511e6f49af?s=32&d=mm&r=g"...

EUVD-2026-110045

Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a through 1.3.14...

EUVD-2026-109991

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11...

EUVD-2026-109990

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

CVE-2026-112839

Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a through 1.3.14...

CVE-2026-116388

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

CVE-2026-93328

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

CVE-2026-44595

CVE-2026-44595 — YAMCS Unauthorized User Enumeration via IAM API Summary The IAM API endpoints listUsers, getUser, listGroups, getGroup in yamcs-core do not enforce the required SystemPrivilege.ControlAccess check. Any authenticated user — even one with no privileges — can enumerate all user...

CVE-2023-26035

CVE-2023-26035 Unauthenticated RCE in ZoneMinder Snapshots - PoC Exploit alt img Description ZoneMinder versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution due to missing authorization checks in the snapshot action. Usage git clone...

CVE-2026-115718

A flaw was found in Frappe Builder. A missing authorization check in the improveprompt endpoint allows an authenticated remote attacker to invoke Large Language Model LLM completions using the site owner's stored credentials. By exploiting this issue, an attacker can exhaust paid service credits...

CVE-2026-93328 Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

CVE-2026-93328

The Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox ) versions 1.2.0 through 1.4.0 contains a Path Traversal and Missing Authorization vulnerability in the cloud-storage source . An unauthenticated remote attacker can exploit this by using crafted tool invocation parameters to exfi...

EUVD-2026-109936

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

CVE-2026-116492

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the getcontactbyphonenumber API, which performs raw database queries without invoking the permission...

autogpt-CVE-2026-30950-poc

AutoGPT CVE-2026-30950 POC Proof-of-concept demonstration for CVE-2026-30950, an authenticated IDOR Missing Authorization in the AutoGPT Platform that lets any logged-in user reassign — and thus hijack — any other user's chat session via a single PATCH request, with no prior access to the session...

route-detect

route-detect Find authentication authn and authorization authz security bugs in web application routes: Routes fromkoel streaming server Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severit...

CVE-2025-11174

CVE-2025-11174: Unauthenticated Information Disclosure in Document Library Lite WordPress Plugin Keywords: CVE-2025-11174, Document Library Lite vulnerability, information disclosure, WordPress security, unauthenticated AJAX exploit, WordPress plugin vulnerability, CWE-862, WordPress document...

CVE-2026-116492

The Frappe CRM app version prior to 1.89.1 is vulnerable to a missing authorization issue (CWE-862). The crm.integrations.api.get_contact_by_phone_number endpoint performs raw database queries without invoking the application's permission system. This allows authenticated low-privileged users to ...

EUVD-2026-109789

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the getcontactbyphonenumber API, which performs raw database queries without invoking the permission...