| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Unauthenticated Broken Access Control in Photography <= 7.7.6 versions. |
| Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions. |
| Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. |
| Subscriber Broken Access Control in ListingPro <= 2.9.10 versions. |
| Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. |
| Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions. |
| The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover. |
| The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data. |
| Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints. |
| A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in
unconfined context
This issue affects policycoreutils through 3.10. |
| Unauthenticated Broken Access Control in Civi <= 2.2.4 versions. |
| FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue. |
| Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions. |
| Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions. |
| This issue was addressed with additional entitlement checks. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to retrieve Safari bookmarks without an entitlement check. |
| Contributor Broken Access Control in uListing <= 2.2.0 versions. |
| Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. |
| Subscriber Broken Access Control in uListing <= 2.2.0 versions. |
| Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions. |
| Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions. |
