Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators. id: CVE-2025-4334 info: name: Simple User Registration = 6.3 -...

Cobbler - Authentication Bypass

Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API /cobblerapi that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting...

Harbor <=1.82.0 - Privilege Escalation

Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration. id: CVE-2019-16097...

Login as User or Customer < 3.3 - Privilege Escalation

The plugin lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session. id: CVE-2022-4305 info: name: Login as User or Customer 3.3 - Privilege Escalation author: r3Y3r53 severity: critical...

KONGA 0.14.9 - Privilege Escalation

KONGA 0.14.9 allows attackers to set higher privilege users to full administration access. The attack vector is a crafted condition, as demonstrated by the /api/user/ID at ADMIN parameter. id: CVE-2021-42192 info: name: KONGA 0.14.9 - Privilege Escalation author: rschio severity: high description...

Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to addrole and userrole functions missing proper capability checks performed through the...

Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation

The plugin is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's...

CVE-2026-12497

Summary: CVE-2026-12497 affects the Paid Membership Plugin family for WordPress (before 4.16.18). The front‑end registration role-selection restriction is not consistently enforced because two parsers derive the offered roles and the accepted roles, allowing some configurations where the handler ...

CVE-2026-14172 Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...

CVE-2026-14172

CVE-2026-14172 affects Rapid7 InsightVM, Nexpose, and the Insight Agent. The issue allows a local, low-privilege user to execute discovered executables during authenticated assessments due to lack of file ownership validation, enabling code execution as the scan credential (Scan Engine) or as roo...

CVE-2026-66141

Exim before 4.99.5 allows .forward privilege escalation because forcecommand for a pipe transport is mishandled...

CVE-2026-66141

Exim before 4.99.5 allows .forward privilege escalation because forcecommand for a pipe transport is mishandled...

CVE-2026-66141

Affected software : Exim before 4.99.5. Vulnerability : .forward privilege escalation due to mishandling of force_command for a pipe transport. Root cause : improper handling of force_command in a pipe transport within Exim, enabling a local attacker to escalate privileges. Impact : high severity...

CVE-2026-66141

Exim before 4.99.5 allows .forward privilege escalation because forcecommand for a pipe transport is mishandled...

EUVD-2026-48479

Exim before 4.99.5 allows .forward privilege escalation because forcecommand for a pipe transport is mishandled...

CVE-2026-66140

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled...

CVE-2026-66140

CVE-2026-66140 affects Exim before 4.99.5. The root cause is mishandling of queue-name arguments, enabling directory traversal outside the spool area and resulting in privilege escalation. Exploitation requires local access (no user interaction) and yields high impact to confidentiality, integrit...

CVE-2026-66140

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled...

EUVD-2026-48478

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled...

CVE-2026-12736

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::saveoption REST route POST /wp-json/wpify-woo/v1/option passing the request-supplied 'option' and 'data' parameters directly to updateoption without a...