10 matches found
CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...
CVE-2026-90923
The Autopay WordPress plugin (versions before 5.0.1 ) is vulnerable to an incorrect authorization flaw because it fails to enforce signatures on specific payment callbacks. This security weakness allows unauthenticated users to perform cross-customer actions, specifically the disclosure and delet...
CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...
WordPress Fancy Product Designer | WooCommerce WordPress plugin <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter vulnerability
Unauthenticated Full Path Disclosure via 'pdf' Parameter vulnerability discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress Plugin Fancy Product Designer versions = 6.4.8...
Dell PowerScale OneFS Parameters Incorrectly Specified Vulnerability
Dell PowerScale OneFS is a proprietary operating system developed by Dell for its PowerScale horizontally scalable NAS network attached storage solution. Dell PowerScale OneFS suffers from an incorrectly specified parameter vulnerability that could be exploited by an attacker to cause an...
IBM Daeja ViewONE Virtual Information Disclosure Vulnerability (NVD-C-2019-144873)
IBM Daeja ViewONE Virtual is an HTML5-based document and image viewer from IBM USA. The product is primarily used to view, annotate and print images and documents. An information disclosure vulnerability exists in IBM Daeja ViewONE Virtual versions 5.0 through 5.0.6, which can be exploited by an...
PHPfileNavigator 2.3.3 Privilege Escalation
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPFILENAVIGATOR0812b.txt Vendor: ========================= pfn.sourceforge.net Product: ===================================================== PHPfileNavigator v2.3.3 pfn...
[SA22040] CakePHP "file" Parameter Disclosure of Sensitive Information
TITLE: CakePHP "file" Parameter Disclosure of Sensitive Information SECUNIA ADVISORY ID: SA22040 VERIFY ADVISORY: http://secunia.com/advisories/22040/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: CakePHP 1.x http://secunia.com/product/11247/...
CVE-2005-2003
Ultimate PHP Board UPB 1.9.6 GOLD allows remote attackers to obtain sensitive information via an invalid zero id parameter to 1 viewtopic.php, 2 profile.php, or 3 newpost.php, which reveals the path in an error message...
