WordPress plugin ldap_login_password_and_role_manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-4607 · Splunk · Splunk App For Soar

Name of the Vulnerable Software and Affected Versions: Splunk App for SOAR versions 1.0.67 and lower Description: The issue is related to improper access control. In the affected versions of the Splunk App for SOAR, the documentation recommended adding the admin all objects capability to the splu...

WordPress plugin Tabs Shortcode 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-21611 tgstation-server's role authorization incorrectly OR'd with user's enabled status

tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to most, but not all, authorized actions...

CVE-2025-21611

CVE-2025-21611 affects tgstation-server (BYOND server management). Before version 6.12.3, the authorization check for API methods used OR between the user-enabled status and the role, instead of AND. This error allowed enabled users to access most authorized actions regardless of their permission...

CVE-2025-21611 tgstation-server's role authorization incorrectly OR'd with user's enabled status

tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to most, but not all, authorized actions...

PT-2025-4299 · Unknown · Tgstation-Server

Name of the Vulnerable Software and Affected Versions: tgstation-server versions prior to 6.12.3 Description: The issue concerns improper role authorization in tgstation-server, a production-scale tool for BYOND server management. Prior to version 6.12.3, roles used to authorize API methods were...

CVE-2024-13142 ZeroWdd studentmanager RoleController. java submitAddRole cross site scripting

A vulnerability was found in ZeroWdd studentmanager 1.0. It has been declared as problematic. This vulnerability affects the function submitAddRole of the file src/main/java/com/zero/system/controller/RoleController. java. The manipulation of the argument name leads to cross site scripting. The...

manager-system 代码注入漏洞

manager-system is a backend management system for ZeroWdd individual developers. A code injection vulnerability exists in manager-system version 1.0, which stems from the parameter name in the file src/main/java/com/zero/system/controller/RoleController.java that can lead to cross-site scripting...

CISA Requests Public Comment for Draft National Cyber Incident Response Plan Update

Today, CISA—through the Joint Cyber Defense Collaborative and in coordination with the Office of the National Cyber Director ONCD—released the National Cyber Incident Response Plan Update Public Comment Draft. The draft requests public comment on the National Cyber Incident Response Plan...

WordPress Hide Category by User Role for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Hide Category by User Role for WooCommerce versions = 2.1.1...

WordPress WP Job Portal plugin <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference vulnerability discovered by Apostolos Sakellariou in WordPress Plugin WP Job Portal versions = 2.2.4...

CVE-2024-11357 Goodlayers Core < 2.0.10 - Contributor+ Stored XSS

The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-11357

CVE-2024-11357 affects the Goodlayers Core WordPress plugin (goodlayers-core). Public details indicate an authenticated stored XSS vulnerability due to insufficient sanitization/escaping of settings, exploitable by users with Contributor+ privileges. Impact is storage and execution of arbitrary s...

CVE-2024-56206

Cross-Site Request Forgery CSRF vulnerability in krishankakkar gap-hub-user-role gap-hub-user-role allows Authentication Bypass.This issue affects gap-hub-user-role: from n/a through = 3.4.1...

CVE-2024-56206 WordPress gap-hub-user-role. plugin <= 3.4.1 - CSRF to Broken Authentication vulnerability

Cross-Site Request Forgery CSRF vulnerability in krishankakkar gap-hub-user-role gap-hub-user-role allows Authentication Bypass.This issue affects gap-hub-user-role: from n/a through = 3.4.1...

CVE-2024-56206

CVE-2024-56206 is a CSRF vulnerability in gap-hub-user-role (WordPress plugin) that allows authentication bypass. Affected: gap-hub-user-role from n/a through 3.4.1. The connected records indicate this CVE as an active issue with patch status reported as Unpatched for the specific entry, and CVSS...

CVE-2024-13069 SourceCodester Multi Role Login System add-user.php cross site scripting

A vulnerability was found in SourceCodester Multi Role Login System 1.0. It has been classified as problematic. Affected is an unknown function of the file /endpoint/add-user.php. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. Th...

CVE-2024-13069 SourceCodester Multi Role Login System add-user.php cross site scripting

A vulnerability was found in SourceCodester Multi Role Login System 1.0. It has been classified as problematic. Affected is an unknown function of the file /endpoint/add-user.php. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. Th...

CVE-2024-13069

CVE-2024-13069 affects SourceCodester Multi Role Login System 1.0. A vulnerability resides in the /endpoint/add-user.php endpoint where manipulation of the name parameter enables cross-site scripting. The issue can be exploited remotely; public PoCs/exploits have been disclosed. Connected sources...