CVE-2026-71241

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. This allows any unauthenticated remote user to retrieve student PII name,...

CVE-2026-11454

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/ REST endpoint. The endpoint's permission callback checks only the role-level...

CVE-2026-11454 Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/ REST endpoint. The endpoint's permission callback checks only the role-level...

CVE-2026-70373 Koha - SQL Injection in reports/issues_stats.pl

Koha's reports/issuesstats.pl the circulation statistics report builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into...

EUVD-2026-52674

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions SELECT...

WordPress FluentCart A New Era of eCommerce plugin < 1.5.3 - Unauthenticated Order PII Disclosure vulnerability

Unauthenticated Order PII Disclosure vulnerability discovered by Diogo Pinto in WordPress Plugin FluentCart versions 1.5.3...

An analysis of incidents at Brazilian educational institutions

Introduction Because of the amount of data that can be obtained and the high impact that successful attacks may have, educational institutions are frequent targets of cybercriminals. Both public and private schools and universities rely on software for managing personally identifiable information...

Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII

Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId with no ownership or session check. Chained, they expose customer PII. GET /locale/thank-you PageRedirectController::thankYouAction, route syliusmollieshopthankyoupageredirect loads the order with...

GHSA-X83G-979R-F5FH Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII

Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId with no ownership or session check. Chained, they expose customer PII. GET /locale/thank-you PageRedirectController::thankYouAction, route syliusmollieshopthankyoupageredirect loads the order with...

CVE-2026-15209

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...

CVE-2026-12376

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

CVE-2026-12376

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

EUVD-2026-51435

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

CVE-2026-12376

The Academy LMS WordPress plugin (versions

EUVD-2026-51426

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...

CVE-2026-15209

The JS Help Desk WordPress plugin versions prior to 3.1.5 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to verify if a requesting user owns the ticket being loaded. Consequently, a low-privileged authenticated user can provide a different user's ticket ID...

CVE-2026-14849 Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data including PII while an export artifact...

EUVD-2026-51417

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data including PII while an export artifact...

CVE-2026-14843

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to...

PT-2026-66685

Name of the Vulnerable Software and Affected Versions Academy LMS WordPress plugin versions prior to 3.8.3 Description An improper access control issue allows any authenticated user with subscriber-level access or higher who is enrolled in at least one course to access quiz attempt records...