CVE-2025-6758

Real Spaces - WordPress Properties Directory テーマ ≤ 3.6 imicagentregister を介した未認証の管理者権限昇格 📝 説明 CVE-2025-6758 CVSS スコア: 9.8 Critical WordPress 用の Real Spaces - WordPress Properties Directory テーマ は、バージョン 3.6 以前のすべてのバージョンにおいて、imicagentregister 関数を介した権限昇格の脆弱性の影響を受けます。...

CVE-2023-32749-PoC

CVE-2023-32749 | Pydio Cells 未授权角色分配 针对影响 Pydio Cells 4.1.2 及更早版本的 CVE-2023-32749 的利用程序。低权限的已认证用户可以创建一个具有所有角色分配的新外部用户，从而获得对该实例中所有单元格和非个人工作区的访问权限。 受影响版本 Pydio Cells 4.1.2 及更早版本 已在 4.2.0、4.1.3、3.0.12 中修复 依赖 root@kitploit: pip install requests 使用方法 从已认证会话中获取一个 Bearer token（开发者工具 网络 任意 /a/ 请求...

GHSA-CQR2-H44G-V75V n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints

Impact The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on...

n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints

Impact The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on...

NPM: n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints

NPM: n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-62183

CVE-2026-62183 — Apache Syncope 用户自助服务权限提升 Apache Syncope 中的不当特权管理（CWE-269） 。经过身份验证的低权限用户 可通过用户自助服务 API 为自己授予任意角色 （以及组成员资格、外部资源 和新领域）——这些操作在其它所有代码路径上都需要管理权限——从而成为 身份库的管理员。 本仓库是此漏洞的技术参考 ：根因、经运行时验证的概念验证（PoC）以及复现说明。关于发现过程的叙述性文章单独发布（见技术文章）。 概览 | ---|--- CVE| CVE-2026-62183 厂商 / 产品| Apache Software...

CVE-2026-86085 n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the...

CVE-2026-86085

n8n (open-source workflow automation platform) prior to 2.37.7 and 2.38.2 suffered a cross-tenant information disclosure vulnerability in its role assignment endpoints (/rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members). The affected controller (packages/cli/src/c...

CVE-2026-86085 n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the...

CVE-2026-82053 Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...

Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...

CVE-2026-85038

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

CVE-2026-85038 B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role Selection

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

CVE-2026-0920-

CVE-2026-0920- LA-Studio Element Kit for Elementor 📡 漏洞利用代码最先在此发布。 在 Telegram 上关注 @KNxploited —— 获取最新披露 CVE、可用 PoC 与精准安全研究的顶尖资讯。持续更新，专为领先者打造。 🧠 概述 CVE-2026-0920 是在 LA-Studio Element Kit for Elementor WordPress 插件中发现的一个 CVSS 9.8 严重级别 漏洞。 该缺陷位于 ajaxregisterhandle 函数中，该函数通过 AJAX 处理未经认证的用户注册流程。该函数未对...

CVE-2026-80467

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...

CVE-2026-15369

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afregselectuserrole value from the unauthenticated WooCommerce Store API...

CVE-2026-10522

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is...

CVE-2026-82240

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

EUVD-2026-67692

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...