CVE-2025-24840

CVE-2025-24840 describes an improper access control vulnerability in Intel’s Edge Orchestrator software for the Intel® Tiber™ Edge Platform, affecting versions before 24.11.1. An unauthenticated user may potentially escalate privileges via adjacent access. The issue is documented with a middle/lo...

CVE-2025-24840

Improper access control for some Edge Orchestrator software before version 24.11.1 for IntelR TiberTM Edge Platform may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...

CVE-2025-8059 B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function

The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfrregistration function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to create a new account and...

WordPress B Blocks plugin <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function vulnerability

Missing Authorization to Unauthenticated Privilege Escalation via rgfrregistration Function vulnerability discovered by Peter Thaleikis in WordPress Plugin B Blocks versions = 2.0.6...

WordPress Simple User Registration 6.3 Privilege Escalation

WordPress Simple User Registration plugin versions 6.3 and below suffer from an unauthenticated privilege escalation vulnerability. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to regist...

WordPress Litho Theme <= 3.0 is vulnerable to Arbitrary File Deletion

Software Litho Type Theme Vulnerable versions = 3.0 Fixed in 3.1 OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2025-49879 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID b5c6a3b3bdf8 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress Backwp plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Backwp versions = 2.0.2...

CVE-2020-0594

Out-of-bounds read in IPv6 subsystem in IntelR AMT and IntelR ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentially enable escalation of privilege via network access...

CVE-2025-4322 Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover

The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to chan...

CVE-2025-2253

CVE-2025-2253 affects the IMITHEMES Listing plugin (≤3.3). The issue is unauthenticated privilege escalation caused by the plugin not properly validating a verification code before updating passwords via imic_reset_password_init(), enabling password changes for any user (including admins) if the ...

CVE-2025-2470

CVE-2025-2470 affects the WordPress plugin Service Finder Bookings (versions up to 5.1). TheRoot cause is a missing restriction on user roles in the function nsl_registration_store_extra_input , allowing unauthenticated attackers to register accounts with arbitrary roles (including Administrator)...

CVE-2025-2470 Service Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'

The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nslregistrationstoreextrainput'...

WordPress Zalo Official Live Chat plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by haudayroi in WordPress Plugin Zalo Official Live Chat versions = 1.0.0...

WordPress Ivy School Theme <= 1.6.0 is vulnerable to Local File Inclusion

Software Ivy School Type Theme Vulnerable versions = 1.6.0 Fixed in 1.6.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39470 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 2982cc652634 Credits Bonds Required privilege Unauthenticated...

WordPress Booster for WooCommerce plugin 4.0.1-7.2.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by luckybuddy in WordPress Plugin Booster for WooCommerce versions 4.0.1-7.2.4...

WordPress Product Table by WBW plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Product Table by WBW versions = 2.1.4...

WordPress Javo Core plugin <= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup vulnerability

Unauthenticated Privilege Escalation in ajaxsignup vulnerability discovered by Tonn in WordPress Plugin Javo Core versions = 3.0.0.080...

PT-2025-7937

Name of the Vulnerable Software and Affected Versions HCL MyCloud affected versions not specified Description The issue is related to Improper Access Control, which is an unauthenticated privilege escalation vulnerability. This may lead to information disclosure and has the potential for...

CVE-2024-12470 School Management System – SakolaWP <= 1.0.8 - Unauthenticated Privilege Escalation

The School Management System – SakolaWP plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.8. This is due to the registration function not properly limiting what roles a user can register as. This makes it possible for unauthenticated attackers to...

CVE-2024-56043

CVE-2024-56043 concerns the WordPress plugin WPLMS by VibeThemes. The vulnerability is an Incorrect Privilege Assignment that allows unauthenticated privilege escalation in WPLMS versions up to 1.9.9. The root cause, as described in the sources, is a privilege assignment error. Impact is describe...