43830 matches found
WordPress Site Reviews plugin 7.2.2-8.2.2 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Site Reviews versions 7.2.2-8.2.2...
WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...
Exploit for CVE-2026-82222
CVE-2026-82222 — GiveWP Unauthenticated PHP Object Injection →...
WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Sybre Waaijer in WordPress Plugin Slim SEO versions = 4.10.0...
CVE-2026-86779 Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...
CVE-2026-88046
A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows an attacker to bypass configured directory restrictions by including parent-directory segments e.g., '..' in source object names. When a specially crafted source object is uploaded or copied, it can...
CVE-2026-11496 Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure
The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...
CVE-2026-81915: Missing Authorization
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...
PT-2026-89913
Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description A mass assignment issue exists in the editer objet action. Unauthenticated attackers can write arbitrary rows to any SQL table that does not have a champs editables allowlist by providing a controlled...
PT-2026-90497
Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description An authorization flaw exists during Express entry submissions where the system validates the authorization check against the entity of the posted form instead of the entity identified by the...
CVE-2024-12145: Missing Authorization
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...
CVE-2026-62103: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...
PT-2026-90020
Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...
PT-2026-90032
Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...
PT-2026-89746
The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on wp aja...
PT-2026-90028
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...
PT-2026-90023
Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...
PT-2026-90021
Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...