plausible-traffic-notify

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · plausible-traffic-notify plausible-traffic-notify Plausible Analytics community edition, GitHub master d44e104ae3943a9240d5cb6b62e67dff0f069d3a 2026-10-16 - Plausible Insights OÜ Class: IDOR mass-assignment. Reach:...

CVE-2026-119565

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

CVE-2026-119564

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it,...

EUVD-2026-113830

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

CVE-2026-119565 Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

CVE-2026-119565 Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

CVE-2026-119565 Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

CVE-2026-119565

Plausible Analytics versions through 3.2.1 are susceptible to a mass assignment vulnerability in the update_traffic_change_notification function. This flaw allows authenticated site editors to reassign notifications by including a site_id parameter in a PUT request to /sites/:domain/traffic-chang...

CVE-2026-119564 Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDs

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it,...

EUVD-2026-113829

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it,...

CVE-2026-119564 Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDs

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it,...

CVE-2026-119564 Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDs

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it,...

CVE-2026-119564

Plausible Analytics Community Edition versions through 3.2.1 are vulnerable to an information exposure flaw on the settings/people page. The vulnerability allows site editors to obtain pending invitation and ownership-transfer IDs . An attacker can exploit this by registering with the invitee's e...

CVE-2026-119565: Plausible Plausible Analytics: Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that…

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

PT-2026-133503

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update traffic change notification that allows authenticated site editors to reassign notifications by supplying a site id parameter. Attackers can submit traffic change notificationsite id set to another site's primary...

PT-2026-133502

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it,...

CVE-2026-119564: Plausible Plausible Analytics: Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site…

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it,...

EUVD-2022-32333

Malicious code in bioql PyPI...

EUVD-2023-45124

Malicious code in bioql PyPI...

DRUPAL-CONTRIB-2025-107

This module integrates Plausible Analytics on a site. The module did not properly filter output in certain cases. This vulnerability is mitigated by the fact that an attacker must have permission to add raw HTML to the website, such as an unfiltered WYSIWYG field on a public-facing comment...