CVE-2025-1639

🔓 Script de Explotación para CVE-2025-1639 📝 Descripción El complemento Animation Addons for Elementor Pro para WordPress es vulnerable a la instalación arbitraria de plugins no autorizada debido a una verificación de capacidad faltante en la función installelementorpluginhandler en todas las...

CVE-2024-54379

CVE-2024-54379 Minterpress = 1.0.5 - Falta de autorización para la actualización arbitraria de opciones por usuarios autenticados Suscriptor+ Descripción El complemento Minterpress para WordPress es vulnerable a la modificación no autorizada de datos que puede conducir a una escalada de privilegi...

CVE-2024-54378

CVE-2024-54378 Quietly Insights = 1.2.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Quietly Insights plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on...

CVE-2026-27344

Control de acceso roto en Inseri Core plugin de WordPress Plugin: Inseri Core Componente afectado: /includes/restapi.php Tipo de vulnerabilidad: Control de acceso roto Falta de autorización Estado: Reportada en agosto de 2026– cerrada como Duplicada. Resumen Mientras realizaba pruebas este verano...

CVE-2021-46704-POC

CVE-2021-46704-POC CVE-2021-46704 GenieACS PoC de Inyección de Comandos Afecta al paquete genieacs, versiones =1.2.0 1.2.8 ¿Cómo solucionarlo? Actualice genieacs a la versión 1.2.8 o superior. Las versiones afectadas de este paquete son vulnerables a Inyección de Comandos a través del argumento...

CVE-2024-34444-Exploit-Poc

CVE-2024-34444 - Escáner de Autorización Faltante de Slider Revolution Escáner masivo profesional para CVE-2024-34444 que afecta al plugin de WordPress Slider Revolution 6.7.0 Banner 🎯 Descripción CVE-2024-34444 es una vulnerabilidad de Autorización Faltante en el plugin de WordPress Slider...

CVE-2026-97337 Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from...

CVE-2022-1203

CVE-2022-1203 Content Mask 1.8.4 - Actualización arbitraria de opciones por Suscriptor+ Descripción El plugin de WordPress Content Mask anterior a la versión 1.8.4.1 no realiza comprobaciones de autorización y CSRF en varias acciones AJAX, y tampoco valida que la opción a actualizar pertenezca al...

CVE-2025-65669

CVE-2025-65669 An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India...

CVE-2025-34171

CVE-2025-34171: Exposición no autenticada de archivos y datos de depuración en CasaOS Resumen de la vulnerabilidad Campo| Valor ---|--- CVE ID| CVE-2025-34171 Afecta| CasaOS ≤ 0.4.15 Corregido en| No hay parche disponible Gravedad| Media CVSS 4.0|...

CVE-2026-105046

Kentico Xperience 13 versions prior to 13.0.216 are vulnerable to an object-level authorization deficiency. The issue stems from a lack of proper authorization checks for administration API endpoints , which may allow unauthorized access to administrative functions. Specific details regarding the...

CVE-2026-105046

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-82041

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2024-11848

CVE-2024-11848 NitroPack = 1.17.0 - Autorización faltante para actualización limitada de opciones con usuario autenticado Suscriptor+ Descripción El plugin NitroPack para WordPress es vulnerable a la modificación no autorizada de datos debido a una verificación de capacidad faltante en la acción...

EUVD-2026-91796

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041

UTMStack versions before 11.2.16 are vulnerable to a missing authorization flaw in the UTMIncidentCommandWebsocket.processCommand() function. Specifically, the handler mapped to the /command/{hostname} STOMP destination fails to perform role checks or apply a command allowlist. This allows any au...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...