Baza CVE

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web…

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team…

Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project…

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with…

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to…

Błąd w Craft CMS pozwala atakującym na odczyt danych użytkowników, w tym administratorów.

Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.

Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.

Atak Denial of Service w WP Go Maps powoduje niedostępność usługi.

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections…

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject…

Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.

Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.

Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.

Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified…

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.

Brak odpowiedniego uciekania XSS w Spark History Server umożliwia eskalację uprawnień w przeglądarce.

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or…

Brak walidacji parametrów w reset_password.html pozwala na przekierowanie użytkowników na złośliwe strony.

Wtyczka Easy Waveform Player dla WordPressa umożliwia atakującym wstrzyknięcie skryptów XSS.

Wstrzyknięcie skryptów w motywie Divi umożliwia atakującym wykonanie dowolnego JavaScriptu.

Brak weryfikacji uprawnień w wtyczce MasterStudy LMS umożliwia ujawnienie statystyk studentów.

Brak ochrony CSRF w wtyczce WC Vendors pozwala atakującym zmieniać status zamówień sprzedawców.