Total
4768 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-2719 | 2025-04-11 | N/A | 6.5 MEDIUM | ||
| The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in versions 1.2.8 to 1.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 1/true on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny access to legitimate users or be used to set some values to true, such as registration. | |||||
| CVE-2025-31041 | 2025-04-11 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in NotFound AnyTrack Affiliate Link Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AnyTrack Affiliate Link Manager: from n/a through 1.0.4. | |||||
| CVE-2025-32542 | 2025-04-11 | N/A | 8.8 HIGH | ||
| Missing Authorization vulnerability in EazyPlugins Eazy Plugin Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Eazy Plugin Manager: from n/a through 4.3.0. | |||||
| CVE-2025-32212 | 2025-04-11 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Specia Theme Specia Companion allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Specia Companion: from n/a through 4.6. | |||||
| CVE-2025-32244 | 2025-04-11 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in QuantumCloud SEO Help allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SEO Help: from n/a through 6.6.1. | |||||
| CVE-2025-32213 | 2025-04-11 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in flothemesplugins Flo Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Flo Forms: from n/a through 1.0.43. | |||||
| CVE-2025-32221 | 2025-04-11 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in Spider Themes EazyDocs allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EazyDocs: from n/a through 2.6.4. | |||||
| CVE-2025-32259 | 2025-04-11 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Alimir WP ULike. This issue affects WP ULike: from n/a through 4.7.9.1. | |||||
| CVE-2024-37255 | 1 Wpmet | 1 Elements Kit Elementor Addons | 2025-04-11 | N/A | 5.3 MEDIUM |
| Missing Authorization vulnerability in Wpmet Elements kit Elementor addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Elements kit Elementor addons: from n/a through 3.1.4. | |||||
| CVE-2022-45819 | 1 Code-atlantic | 1 Popup Maker | 2025-04-11 | N/A | 3.5 LOW |
| Missing Authorization vulnerability in Popup Maker Popup Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Maker: from n/a through 1.17.1. | |||||
| CVE-2022-45826 | 1 Sunshinephotocart | 1 Sunshine Photo Cart | 2025-04-11 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 2.9.13. | |||||
| CVE-2022-47594 | 1 Wpdeveloper | 1 Essential Blocks | 2025-04-11 | N/A | 6.5 MEDIUM |
| Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 3.8.5. | |||||
| CVE-2021-35001 | 1 Bmc | 1 Track-it\! | 2025-04-11 | N/A | 6.5 MEDIUM |
| BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetData endpoint. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-14527. | |||||
| CVE-2025-32220 | 1 Salonbookingsystem | 1 Salon Booking System | 2025-04-11 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in Dimitri Grassi Salon booking system allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Salon booking system: from n/a through 10.10.7. | |||||
| CVE-2012-4245 | 1 Gimp | 1 Gimp | 2025-04-11 | 6.8 MEDIUM | N/A |
| The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the python-fu-eval command. | |||||
| CVE-2024-7031 | 1 Ninjateam | 1 Filester | 2025-04-10 | N/A | 7.5 HIGH |
| The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as .php to be uploaded. | |||||
| CVE-2025-26378 | 1 Q-free | 1 Maxtime | 2025-04-10 | N/A | 8.8 HIGH |
| A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests. | |||||
| CVE-2025-26367 | 1 Q-free | 1 Maxtime | 2025-04-10 | N/A | 4.3 MEDIUM |
| A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to create arbitrary user groups via crafted HTTP requests. | |||||
| CVE-2025-26371 | 1 Q-free | 1 Maxtime | 2025-04-10 | N/A | 8.8 HIGH |
| A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to add users to groups via crafted HTTP requests. | |||||
| CVE-2025-26376 | 1 Q-free | 1 Maxtime | 2025-04-10 | N/A | 6.5 MEDIUM |
| A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to modify user data via crafted HTTP requests. | |||||