757 matches found
PT-2025-14835 · WordPress · Uncanny Automator
Name of the Vulnerable Software and Affected Versions: Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress versions up to, and including, 6.3.0.2 Description: The issue is due to the add role and user role functions missing proper capability checks...
CVE-2025-31285
A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the...
CVE-2024-11847
The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks...
U.S. Dept Of Defense: Information Disclosure in API Endpoint /users
An endpoint /users was exposing sensitive user information, including id, first name, last name, email, role, and authdata, to unauthenticated users. This allowed anyone to retrieve private user details without authentication...
CVE-2025-25114
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ehabstar User Role user-roles allows Reflected XSS.This issue affects User Role: from n/a through = 1.0...
CVE-2025-25015
CVE-2025-25015 – Kibana prototype pollution leading to arbitrary code execution . Affected: Kibana versions >= 8.15.0 and
PT-2025-9821
Name of the Vulnerable Software and Affected Versions Kibana versions 8.15.0 through 8.17.2 Description Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions = 8.15.0 and 8.17.1, this is exploitable by...
CVE-2025-25114
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ehabstar User Role user-roles allows Reflected XSS.This issue affects User Role: from n/a through = 1.0...
CVE-2025-25114
CVE-2025-25114 affects the WordPress plugin WordPress User Roles (WordPress User Roles plugin) versions <= 1.0, with a Reflected Cross-Site Scripting (XSS) flaw. The initial record attributes this to Improper Neutralization of Input During Web Page Generation, enabling reflected XSS. The CVSS ...
CVE-2025-25114 WordPress User Role plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ehabstar User Role user-roles allows Reflected XSS.This issue affects User Role: from n/a through = 1.0...
CVE-2025-25114 WordPress User Role plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ehabstar User Role user-roles allows Reflected XSS.This issue affects User Role: from n/a through = 1.0...
WordPress plugin User Role 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...
GHSA-C85W-X26Q-CH87 Formwork improperly validates input of User role preventing site and panel availability
Summary Improper validation of select fields allows attackers to craft an input that crashes the system, resulting in a 500 status and making the entire site and administration panel unavailable. This clearly impacts the Availability aspect of the CIA triad confidentiality, integrity, and...
Formwork improperly validates input of User role preventing site and panel availability
Summary Improper validation of select fields allows attackers to craft an input that crashes the system, resulting in a 500 status and making the entire site and administration panel unavailable. This clearly impacts the Availability aspect of the CIA triad confidentiality, integrity, and...
CVE-2025-1682
The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'savesettings' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the default user ro...
CVE-2025-1682
CVE-2025-1682 concerns the WordPress Cardealer theme (versions <= 1.6.4). The root cause is a missing capability check in the save_settings function, enabling an authenticated user with subscriber-level access or higher to perform an Arbitrary Theme Option Update and escalate privileges by cha...
CVE-2024-13113 Countdown Timer for Elementor < 1.3.7 - Contributor+ Stored XSS
The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...
CVE-2024-57378
Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability. This issue allows the unauthorized creation of internal users without assigning any existing user role, potentially leading to privilege escalation or unauthorized access to sensitive resources...
CVE-2024-13643
CVE-2024-13643 relates to the Zox News – Pro WordPress Theme plugin (WordPress) with versions up to 3.17.0. The root cause, per Wordfence and related sources, is missing authorization checks in backup_options() and reset_options(), allowing authenticated users with Subscriber-level access and abo...
PT-2025-6204 · Siemens · Scalance Wam766-1 +4
Name of the Vulnerable Software and Affected Versions: SCALANCE WAB762-1 versions prior to V3.0.0 SCALANCE WAM763-1 versions prior to V3.0.0 SCALANCE WAM763-1 ME versions prior to V3.0.0 SCALANCE WAM763-1 US versions prior to V3.0.0 SCALANCE WAM766-1 versions prior to V3.0.0 SCALANCE WAM766-1 ME...