CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

Summary An authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included in the ownership verification performed by...

GHSA-RJPF-7PF5-Q54X wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

Summary An authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included in the ownership verification performed by...

CVE-2024-37081

CVE-2024-37081: Multiple Local Privilege Escalation in VMware vCenter Server The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileg...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion. Primary advisory: GHSA-qv97-83w4-ff86 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project|...

CVE-2020-6287

CVE-2020-6287 SAP NetWeaver AS JAVA LM Configuration Wizard Authentication Bypass Create Simple & Administrator Java User SAP NetWeaver is SAP’s integrated technology platform and the technical foundation of all SAP applications since SAP Business Suite. SAP NetWeaver is a service-oriented...

CVE-2026-12793

CVE-2026-12793 — Escalation de privilèges non authentifiée dans JetFormBuilder Scanner proof-of-concept et exploit pour CVE-2026-12793 dans le plugin WordPress JetFormBuilder — Dynamic Blocks Form Builder Crocoblock. | ---|--- CVE| CVE-2026-12793 Plugin| jetformbuilder Affecté| ≤ 3.6.2 Corrigé...

WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Hiro Code016Hiro in WordPress Plugin Dynamic User Directory versions = 2.4...

CVE-2025-57392

CVE-2025-57392 🔒 Security Vulnerability Report Product: BenimPOS Desktop V3.0 Vulnerability Type: Insecure File Permissions Affected Components: BenimPOS.exe, unins000.exe, System.Data.SQLite.dll Vulnerability Class: CWE-276: Incorrect Default Permissions Proof of Concept by: Fatih Bülbül Test...

CVE-2026-97146

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the...

CVE-2026-92393

Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE...

CVE-2026-42720

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4...

CVE-2025-32462-32463-Detection-Script-

CVE-2025-32462-32463-Detection-Script- Vulnerabilità critiche di Sudo consentono agli utenti locali di ottenere l'accesso root su Linux, con impatto sulle principali distribuzioni Una breve descrizione delle vulnerabilità è riportata di seguito - CVE-2025-32462 punteggio CVSS: 2.8 - Sudo preceden...

CVE-2026-42720 WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4...

CVE-2026-42720

The Dynamic User Directory WordPress plugin (versions up to and including 2.4 ) is vulnerable to a Blind SQL Injection due to improper neutralization of special elements used in an SQL command. This vulnerability allows an attacker to execute unauthorized database queries. No specific remediation...

EUVD-2026-94263

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4...

CVE-2026-42720 WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4...

WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Dynamic User Directory versions = 2.4...

Exploit for Session Fixation in Zammad

CVE-2026-102489 - The Cookie in the Error Message PoC materia...

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 con Metasploit-Framework La vulnerabilità CVE-2019-0708 aggira l'autenticazione sfruttando i controlli di autenticazione dell'utente, permettendo a un attaccante di connettersi tramite il protocollo RDP senza alcuna interazione e di inviare codice malevolo per eseguire...