CWE-862

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling be

Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an a

Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, crea

The AffiliateX – Amazon Affiliate Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to

Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute

Missing Authorization vulnerability in bdthemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Config

The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `

The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `lsow_admin_aj

The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `labb_a

Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before

Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.

The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentica

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport expor

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power"

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0

A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipul

A security flaw has been discovered in Flycatcher Toys smART Pixelator 2.0. Affected by this issue is some unknown funct

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletF

Missing Authorization vulnerability in PixFort pixfort Core pixfort-core allows Exploiting Incorrectly Configured Access

A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of th

Missing Authorization vulnerability in UiPress UiPress lite uipress-lite allows Exploiting Incorrectly Configured Access

Missing Authorization vulnerability in LiquidThemes Ave Core ave-core allows Exploiting Incorrectly Configured Access Co

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/PlayLists/View/Playlists

Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthoriz

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access C

Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly Configured Access Contro

A vulnerability was found in LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b. Thi

Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.

Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions.

Subscriber Broken Access Control in MainWP <= 6.1.1 versions.

A security flaw has been discovered in zhayujie CowAgent up to 2.1.0. The impacted element is an unknown function of the

A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown function of the file

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that al

A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file to

A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvo

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMe

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration

Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.

Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/in

Unauthenticated Broken Access Control in Anti Spam and list cleaner &#8211; AcyChecker <= 2.0.0 versions.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on th

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbi

Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval d