1537 matches found
RegistrationMagic <= 5.0.1.7 - Authentication Bypass
RegistrationMagic WordPress plugin versions = 5.0.1.7 contain an authentication bypass caused by missing identity validation in socialloginusingemail, letting unauthenticated users log in as any site user, exploit requires knowing a valid username. id: CVE-2021-4073 info: name: RegistrationMagic ...
WordPress Pie Register <= 3.7.1.4 - Authentication Bypass
An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting socialsite=true and manipulating the useridsocialsite parameter,...
CVE-2026-68759
A holder of a valid integration credential may impersonate other users under specific conditions...
CVE-2026-70429
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could...
CVE-2026-68757
A user with access to a valid SAML response may impersonate another user under specific conditions...
EUVD-2026-57258
A holder of a valid integration credential may impersonate other users under specific conditions...
CVE-2026-68759 Integration credential holders may impersonate users in JFrog Access
A holder of a valid integration credential may impersonate other users under specific conditions...
CVE-2026-68759
A holder of a valid integration credential may impersonate other users under specific conditions...
EUVD-2026-57253
A user with access to a valid SAML response may impersonate another user under specific conditions...
PT-2026-71129
A holder of a valid integration credential may impersonate other users under specific conditions...
CVE-2026-70429
CVE-2026-70429 affects Jenkins 2.575 and earlier (and LTS 2.568.1 and earlier) where case-insensitive comparison of user/group names is inconsistent, enabling attackers to create names that case-insensitively match existing ones to impersonate users or gain permissions. The advisory notes that Je...
CVE-2026-70429
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in...
EUVD-2026-52171
The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID...
PT-2026-64840
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...
CVE-2026-16745
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...
CVE-2026-13410
Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSLverifymode explicitly disabled. An attacker with network man-in-the-middle MITM capability between the Dancer application and googleapis.com can intercept the...
CVE-2026-13410 Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled
Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSLverifymode explicitly disabled. An attacker with network man-in-the-middle MITM capability between the Dancer application and googleapis.com can intercept the...
User Impersonation
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to User Impersonation via the allowFrom feature binding to mutable display names. An attacker can gain unauthorized access to actions requiring higher privileges by manipulating the display...
User Impersonation
Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...