CVE-2023-51679

CVE-2023-51679 affects the BulkGate SMS Plugin for WooCommerce (WordPress) up to version 3.0.2. Multiple sources (NVD, RH/Red Hat, CNNVD) describe it as a Missing/Broken Authorization vulnerability stemming from lack of proper authorization validation. Reported CVSS metrics in NVD indicate CVSS 3...

CVE-2023-51680

Summary: CVE-2023-51680 affects the WordPress plugin “Quotes for WooCommerce.” The root cause is missing authorization checks leading to Broken Access Control in AJAX actions. The vulnerability exists in versions up to and including 2.0.1 and can allow manipulation of quotes by authenticated user...

CVE-2023-52117

Technical details for CVE-2023-52117 are not provided in the connected documents. According to the initial description, this is a Missing Authorization vulnerability affecting ProfileGrid

CVE-2023-52177

CVE-2023-52177 affects the WordPress plugin Integrate Google Drive by SoftLab with Missing Authorization (Broken Access Control) in versions from n/a to 1.3.3. The available sources confirm affected software and root cause, but provide no public details on exploit vectors, impact beyond what’s st...

PT-2024-37226 · Quay · Quay

Name of the Vulnerable Software and Affected Versions: Quay affected versions not specified Description: A vulnerability was found in Quay, where an attacker can use an OAuth token to authenticate despite not having access to the organization from which the application was created, if they obtain...

CVE-2024-23503

CVE-2024-23503 (Ninja Tables

CVE-2023-51519

CVE-2023-51519 (Soliloquy Slider for WordPress) is represented in connected sources as a Missing Authorization/Broken Access Control vulnerability affecting Soliloquy Slider by Soliloquy, specifically versions up to and including 2.7.2. The connected enrichment references this as a Broken Access ...

CVE-2024-23521

CVE-2024-23521 concerns the WordPress plugin Happyforms. Affected: Happyforms versions up to and including 1.25.10. Root cause: Missing authorization checks enabling unauthenticated users to perform unauthorized actions. Public detail confirms a Broken Access Control vulnerability with low CVSS v...

CVE-2023-51498

CVE-2023-51498 is a Missing Authorization vulnerability (Broken Access Control) in the WordPress plugin WooCommerce Canada Post Shipping , affecting versions up to 2.8.3. The connected Red Hat advisory notes the issue and confirms a patch is available (patched). No exploit details are provided in...

CVE-2023-52217

CVE-2023-52217 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin “WooCommerce Conversion Tracking.” Affected are versions up to 2.0.11; the issue stems from missing authorization controls in the plugin’s operations. The CVE entry notes a patch is available i...

CVE-2023-52186

CVE-2023-52186 is a missing-authz vulnerability in the WordPress plugin “WooCommerce Product Vendors” affecting versions up to 2.2.2. The CVE’s base metrics (NVD) show CVSS 3.1, 5.3 (Medium), with network attack vector, no privileges required, no user interaction, and no confidentiality impact bu...

Amazon AWS Deployment Framework Security Vulnerability

Amazon AWS Deployment Framework is a broad and flexible framework from Amazon.com, Inc. for managing and deploying resources across multiple AWS accounts and regions within an AWS organization. A security vulnerability exists in Amazon AWS Deployment Framework versions prior to 4.0.0 that stems...

Lunary Improper Access Control Vulnerability

lunary is lunary open source a production toolkit for LLM . An improper access control vulnerability exists in lunary, which can be exploited by an attacker to update any organization user as the organization owner...

CVE-2024-22296

CVE-2024-22296 corresponds to a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin 12 Step Meeting List. Public records show affected versions are 3.14.28 and earlier, with exploitation potential via an unauthenticated or improperly authorized access to the plugin...

CVE-2024-22298

CVE-2024-22298 describes a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Amelia Booking. The affected versions are Amelia Booking ≤ 1.0.98, with unauthenticated attackers able to access restricted actions due to missing authorization checks. Patchstack notes ...

CVE-2024-21751

CVE-2024-21751 concerns the WordPress plugin RabbitLoader up to version 2.19.13, where multiple AJAX actions lack proper authorization checks, allowing authenticated users with subscriber-level access and above to modify data (e.g., purge site cache or switch caching modes) without permission. Th...

CVE-2024-5389

In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properly validating the ownership of dataset...

CVE-2024-25929

CVE-2024-25929: WordPress plugin Product Catalog Enquiry for WooCommerce by MultiVendorX

CVE-2024-25092

CVE-2024-25092 is a Missing Authorization vulnerability in WordPress NextMove Lite (XLPlugins NextMove Lite) affecting all versions through 2.17.0. An authenticated user with subscriber-level privileges or higher can install and activate arbitrary plugins due to a missing capability check (xl_add...

CVE-2024-24716

Technical details about CVE-2024-24716 (Awesome Support Missing Authorization) are not publicly provided in the connected documents. No exploit, affected versions beyond 6.1.6, or remediation specifics are given. Monitor vendor advisories for updates.