CVE-2005-1586

Quick.Forum 2.1.6 stores potentially sensitive information such as usernames, banned IP addresses, censored words, and backups under the web document root, which allows remote attackers to obtain that information via a direct request to 1 db/users.txt, 2 db/banList.txt, 3 db/censureWords.txt, or ...

CVE-2024-30616

Chamilo LMS version 1.11.26 is vulnerable to Incorrect Access Control via the main/auth/profile endpoint. This flaw allows non-admin users to manipulate sensitive profile information, which poses a significant risk to data integrity . To remediate this vulnerability, users are recommended to upda...

CVE-2024-8434

CVE-2024-8434 affects the Easy Mega Menu Plugin for WordPress – ThemeHunk. A missing capability check on several AJAX-hooked functions allows authenticated users with subscriber-level access and above to perform actions such as updating plugin settings in all versions up to 1.0.9. The vulnerabili...

Improper Access Control

aimeos/ai-admin-graphql is vulnerable to an Improper Access Control. The vulnerability is due to insufficient restrictions or checks on user roles and permissions, allowing an editor to modify and take over an admin account in the back end...

WordPress Youzify Plugin <= 1.2.2 is vulnerable to Insecure Direct Object References (IDOR)

Software Youzify Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-47191 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID bc5ca1802a20 Credits lttn Required...

CVE-2022-45760

SENS v1.0 is vulnerable to Incorrect Access Control vulnerability...

Improper Access Control

mautic/core is vulnerable to improper access control. The vulnerability exists in .htaccess due to the use of improper regex which allows an attacker to perform unauthorized access...

Default Password ('!2345Asdfg') for 'root' Account

The account 'root' on the remote host has the password '!2345Asdfg'. An attacker may leverage this issue to gain access, likely as an administrator, to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "root"; password = "!2345Asdfg";...

Improper Access Control

unboundid-ldapsdk is vulnerable to improper access control. The vulnerability exists due to the lack of check for password in the synchronous process operation found in SimpleBindRequest...