CWE-862

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX han

The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce

Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a partici

A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This componen

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templa

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the stand

The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on seve

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authentica

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriv

The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or non

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any

Subscriber Broken Access Control in Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms <= 6.0 versions.

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Sec

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azu

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccess

Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.

Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.

Contributor Broken Access Control in WpEvently <= 5.5.0 versions.

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission check

The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User

CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retr

Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows

The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel

The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of d

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a m

Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access

Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control S

The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress is vulnerable to unautho

The Moosend Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capab

The Unify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulne

The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized order status modificatio

Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured Access Control Secur

Missing Authorization vulnerability in Re Gallery allows Exploiting Incorrectly Configured Access Control Security Level

Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beav

The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorizat

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc

The Contact Form vCard Generator plugin for WordPress is vulnerable to unauthorized access of data due to a missing capa

Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.

The miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress is vulnerable to unauthorized

The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a

The Perfit WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including,

The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of da

The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending du

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions