Broken access control.

Kameleo Local API profiles information disclosure

• Kameleo
• Information disclosure
• Broken access control

Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure

• Kameleo
• Information disclosure
• Broken access control

MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

• maccmspro maccms10
• magicblack maccms10
• Broken access control

Kameleo Profile Controller t.cs ListProfiles information disclosure

• Kameleo
• Information disclosure
• Broken access control

A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}).

• Broken access control

Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API

• frappe crm
• Broken access control

JIZHICMS Front-end Order OrderController.php pay improper authorization

• JIZHICMS
• Privilege escalation
• Broken access control

Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

• frappe builder
• Broken access control

WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability

• Contact Form by Supsystic
• Broken access control

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

• WPExperts APIExperts Square for WooCommerce
• Broken access control

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

• WPExperts APIExperts Square for WooCommerce
• Broken access control

WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability

• Dylan Kuhn Geo Mashup
• Broken access control

WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability

• WP Smart Widgets Better Post & Filter Widgets for Elementor
• Broken access control

WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability

• Magepeople inc. Booking and Rental Manager
• Broken access control

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability

• WProyal Royal Elementor Addons
• Broken access control

WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability

• VillaTheme Bopo – WooCommerce Product Bundle Builder
• Broken access control

WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability

• WP Discussion Board
• Broken access control

Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload

• Oray Pugongying X5 Pro
• Broken access control
• Unrestricted file upload

WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability

• VillaTheme DEPART
• Broken access control

WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability

• Meow Apps AI Engine
• Broken access control

An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

• Broken access control

>=1.22.0, <3.37.2 · fixed in 3.37.2

Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery

• Mintpay for WooCommerce
• Broken access control

CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery

• CCAvenue Payment Gateway for WooCommerce
• Broken access control

NocoDB Sign-in Endpoint AuthService.validateUser information disclosure

• NocoDB
• Information disclosure
• Broken access control

Incorrect default permissions in Ministry of Land, Infrastructure, Transport and Tourism…

• Ministry of Land, Infrastructure, Transport and Tourism, Japan Electronic delivery item Inspection Support System
• Broken access control

GouGuOA Api.php chunkUpload unrestricted upload

• GouGuOA
• Broken access control
• Unrestricted file upload

openbq-org OpenBB Local API Server api_settings.py access control

• openbq-org OpenBB
• Privilege escalation
• Broken access control

Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization

• Datafeedr Product Sets Plugin
• Broken access control

HeyCyan App FileProvider access control

• HeyCyan App
• Privilege escalation
• Broken access control

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl.

• Broken access control

AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

• Broken access control

>=0.38.0, <2.15.2 · fixed in 2.15.2

AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

• Broken access control

>=2.6.22, <2.15.2 · fixed in 2.15.2

Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

• Broken access control

>=3.24.0, <3.37.1 · fixed in 3.37.1

KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload

• KodCloud KodExplorer
• Broken access control
• Unrestricted file upload

OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId

• openremote core
• Broken access control

OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos

• openremote core
• Broken access control

OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

• openremote core
• Broken access control

YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts

• yeswiki
• Broken access control

Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

• grokability snipe-it
• Broken access control

Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads

• rclone
• Broken access control

phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID

• thorsten phpMyFAQ
• Broken access control

Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB

• parse-community parse-server
• Broken access control

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing

• ImageMagick
• Broken access control

LinkStackOrg LinkStack cross-site request forgery

• LinkStack
• Cross-site request forgery (CSRF)
• Broken access control

ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

• ProjectSend
• Broken access control

Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router

• dokploy
• Broken access control

InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings

• InstaWP Connect
• Broken access control

WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR

• WPVR
• Broken access control

WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

• WPVR
• Broken access control

WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard

• WPVR
• Broken access control

GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses

• GiveWP
• Broken access control

GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant

• GiveWP
• Broken access control

Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature

• Chikkili- Google Pay India for Woocommerce
• Broken access control

prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload

• prasathmani TinyFileManager
• Broken access control
• Unrestricted file upload

FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization

• FaveoSuite Faveo Helpdesk
• Broken access control

Forged signed tokens let any registered user take over other users and organizations

• GitroomHQ postiz-app
• Authentication bypass
• Broken access control

WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability

• Knit Pay UPI QR Code Payment Gateway for WooCommerce
• Broken access control

WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability

• Magepeople inc. WpEvently
• Broken access control

BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages

• BookStack
• Broken access control

ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint

• ONEARMY community-platform
• Broken access control