350 matches found
CVE-2023-2627
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings...
CVE-2022-1653
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks...
CVE-2011-3997
Opengear console servers with firmware before 2.2.1 allow remote attackers to bypass authentication, and modify settings or access connected equipment, via unspecified vectors...
SAMSUNG Flow 安全漏洞
SAMSUNG Flow is a software product from the South Korean company Samsung SAMSUNG. It is used to enable a seamless, secure, and connected experience on devices. A security vulnerability exists in SAMSUNG Flow versions prior to 4.9.17.6 that stems from insufficient validation of intent by the...
CVE-2024-13420
Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsfresetsectionoptions', 'gsfresetsectionoptions', 'gsfcreatepresetoptions' and more in various versions. This makes it possible for authenticated...
CVE-2025-2567: Missing Authentication for Critical Function
An attacker could modify or disable settings, disrupt fuel monitoring and supply chain operations, leading to disabling of ATG monitoring. This would result in potential safety hazards in fuel storage and transportation...
CVE-2025-30107
On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in the dashcam's configuration management allows unauthorized users to modify settings, disable critical functions, and turn off battery...
CVE-2025-30138
An issue was discovered on G-Net Dashcam BB GONX devices. Managing Settings and Obtaining Sensitive Data and Sabotaging Car Battery can be performed by unauthorized persons. It allows unauthorized users to modify critical system settings once connected to its network. Attackers can extract...
PT-2025-10405
Name of the Vulnerable Software and Affected Versions RomethemeKit For Elementor plugin for WordPress versions up to, and including, 1.5.3 Description The issue allows authenticated attackers with Subscriber-level access and above to modify plugin settings or reset plugin widgets to their default...
The vulnerability of the Smart IP Ban module in the Drupal CMS system allows a violator to view and modify settings.
The vulnerability of the Smart IP Ban module in the Drupal CMS system is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to remotely view and modify settings...
CVE-2024-12511
With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access...
PT-2025-3732
Name of the Vulnerable Software and Affected Versions Four-Faith F3x36 router version 2.0.0 Description The issue concerns an authentication bypass in the administrative web server of the Four-Faith F3x36 router. Specifically, authentication is not enforced on some administrative functionality wh...
CVE-2025-0939
The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke tho...
PT-2025-2165 · WordPress · Ni Sales Commission For Woocommerce
Name of the Vulnerable Software and Affected Versions: Ni Sales Commission For WooCommerce plugin for WordPress versions up to, and including, 1.2.4 Description: The issue is related to unauthorized access due to a missing capability check on the "niwoosc ajax" AJAX endpoint. This allows...
CVE-2024-13415: Missing Authorization
The Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response function in all versions up to, and including, 5.1.4. This makes it possible for authenticated attackers, with...
PT-2025-1817 · WordPress · Lazyload Background Images
Name of the Vulnerable Software and Affected Versions: LazyLoad Background Images plugin for WordPress versions up to and including 1.0.7 Description: The issue arises from a missing capability check on the pblzbg save settings function, allowing authenticated attackers with Subscriber-level acce...
PT-2024-16370 · WordPress · Ti Woocommerce Wishlist
Name of the Vulnerable Software and Affected Versions: TI WooCommerce Wishlist plugin for WordPress versions prior to 2.9.2 Description: The issue concerns a missing capability check in the wizard function, allowing unauthenticated attackers to create new pages, modify plugin settings, and perfor...
CVE-2024-41968
A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS...
Quick Heal Antivirus Pro 安全漏洞
Quick Heal Antivirus Pro is an antivirus software from Quick Heal India. A security vulnerability exists in Quick Heal Antivirus Pro version 24.1.0.182 and prior versions, which stems from the presence of faulty access control that allows an authenticated attacker with low-level privileges to...
