Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended,…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not <granted-tag> to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_save_signature_image' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
CVSS
5,3
EPSS
0,18 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not <granted-tag> to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_save_signature_image' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
5,3
0,18 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.