56 matches found
CVE-2026-13175
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...
EUVD-2026-57106
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...
CVE-2026-13729 Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request CSRF when a logged-in administrator is tricked into...
CVE-2026-6803
CVE-2026-6803 affects the WordPress plugin AI Chatbot & Workflow Automation by AIWU (≤ v1.4.12). The vulnerability arises from missing authorization checks on AJAX actions (wp_ajax_ and wp_ajax_nopriv_) where getPermissions() returns an empty array and removeGroup/clear are not added to getNonced...
EUVD-2026-43134
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to missing capability checks and nonce verification on AJAX actions registered under both wpajax and wpajaxnopriv hooks, as the base...
PT-2026-57398
Name of the Vulnerable Software and Affected Versions AI Chatbot & Workflow Automation by AIWU versions prior to 1.4.13 Description The plugin contains a missing authorization flaw resulting from the absence of capability checks and nonce verification on AJAX actions registered under wp ajax and ...
CVE-2018-25391
HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record's id. The admin/modul/modpengurus/aksipengurus.php module=pengurus&act=hapus and...
CVE-2018-25391 HaPe PKH 1.1 Missing Authorization Allows Unauthenticated Record Deletion
HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record's id. The admin/modul/modpengurus/aksipengurus.php module=pengurus&act=hapus and...
Sitejo HaPe PKH 安全漏洞
Sitejo HaPe PKH is a community poverty alleviation project management system developed by Sitejo Corporation. Version 1.1 of Sitejo HaPe PKH contains a security vulnerability. This vulnerability stems from the lack of authorization for the record deletion endpoint, which may allow unauthenticated...
PT-2026-44869
HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record's id. The admin/modul/mod pengurus/aksi pengurus.php module=pengurus&act=hapus and...
CVE-2026-40836
CVE-2026-40836 describes an unauthenticated SQL Injection in the inmessage model that can be exploited by a low-privileged remote attacker. The vulnerability arises from improper neutralization of special elements in a SQL DELETE command, enabling reading of the entire database and deletion of en...
PT-2026-43254
OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the...
CVE-2026-44548 ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)
ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php causes a logged-in ChurchCRM user with the relevant role to silently delete records,...
CVE-2026-38566
HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms password change at /profile, candidate deletion at /candidates/delete/, feedback submission at /feedback/add/, interview scheduling at /interviews/add are vulnerable to CSRF. An attacker who can...
ChurchCRM 跨站请求伪造漏洞
ChurchCRM is an open-source CRM system developed for churches. Versions of ChurchCRM prior to 7.3.2 contained a cross-site request forgeing vulnerability. This vulnerability originated from a top-level cross-site GET navigation request and could potentially allow logged-in users to delete records...
CVE-2025-13987
CVE-2025-13987 affects the WordPress plugin Purchase and Expense Manager up to version 1.1.2. The issue is a Cross-Site Request Forgery (CSRF) due to missing nonce validation in the function sup_pt_handle_deletion . This allows unauthenticated attackers to delete arbitrary purchase records by tri...
EUVD-2019-14137
Malware in sbrugna...
EUVD-2021-13574
Malware in sbrugna...