Privilege escalation.

WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

• Javier Carazo Import and export users and customers
• Privilege escalation

WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

• Nexcess GiveWP
• Privilege escalation

WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability

• Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications
• Privilege escalation

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

• PublishPress Capabilities
• Privilege escalation

WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

• DexignZone JobZilla - Job Board WordPress Theme
• Privilege escalation

WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

• Tourfic AI Studio Tourfic Pro
• Privilege escalation

WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability

• AmentoTech Doctreat Core
• Privilege escalation

WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

• WebAppick Challan
• Privilege escalation

WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

• eLightUp Meta Box AIO
• Privilege escalation

WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability

• AmentoTech Taskbot
• Privilege escalation

jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization

• jishenghua jshERP
• Privilege escalation
• Broken access control

chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization

• chillzhuang SpringBlade
• Privilege escalation
• Broken access control

chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization

• chillzhuang SpringBlade
• Privilege escalation
• Broken access control

PickMall Lilishop Mobile Binding bindMobile improper authorization

• PickMall Lilishop
• Privilege escalation
• Broken access control

Nx daemon and plugin worker sockets are accessible to other local users

• Privilege escalation
• Broken access control

>=14.6.0, <22.7.9 || >=23.0.0, <23.1.2 · fixed in 22.7.9, 23.1.2

Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)

• penpot
• Privilege escalation

Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection

• penpot
• Privilege escalation
• Broken access control

Improper privilege management in Google Android

• Google Android
• Privilege escalation

Improper privilege management in Google Android

• Google Android
• Privilege escalation

Improper privilege management in Google Android

• Google Android
• Privilege escalation

Improper privilege management in Google Android

• Google Android
• Privilege escalation

Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles

• plane
• Privilege escalation

onetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization

• onetwothreeneth HospitalManagementSystem
• Privilege escalation
• Broken access control

Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)

• plane
• Privilege escalation
• Broken access control

Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization

• Totolink A3002MU
• Privilege escalation
• Broken access control

LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering

• laradashboard
• Privilege escalation

Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /…

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Privilege escalation

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

• Privilege escalation

<1.0.9-0.20260731160927-34bfa1915022 · fixed in 1.0.9-0.20260731160927-34bfa1915022

Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter

• DiviEngine Divi Membership
• Privilege escalation

Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login

• WebRehab Super Forms – Drag & Drop Form Builder
• Privilege escalation

EasyIO FG

• Johnson Controls Easy IO FG
• Privilege escalation

VxWorks 7 improper privilege management

• Wind River Systems Inc VxWorks 7
• Privilege escalation

Foreman: excessive permissions for viewer role on preview

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Privilege escalation

Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

• Apache Software Foundation Apache HTTP Server
• Privilege escalation

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

• Privilege escalation
• Broken access control

<3.11.7 · fixed in 3.11.7

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

• Privilege escalation
• Broken access control

<3.11.7 · fixed in 3.11.7

WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability

• ByteCore Stack ByteCoreStack &#8211; MCP Connector for AI Tools
• Privilege escalation

WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability

• Paul Ryan Authorizer
• Privilege escalation

HCL iControl is affected by multiple security vulnerabilities

• HCL Software iControl
• Privilege escalation

Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications

• Ghost
• Privilege escalation

JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user…

• JetBrains YouTrack
• Privilege escalation

WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint

• wpclever WPC Shop as a Customer for WooCommerce
• Privilege escalation

ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

• ByteCoreStack – MCP Connector for AI Tools
• Privilege escalation

Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

• WebRehab Super Forms – Drag & Drop Form Builder
• Privilege escalation

Genians, Inc Genian SSL PNS Improper Privilege Management

• Genians, Inc Genian SSL PNS (frodo-core)
• Genians, Inc Genian SSL PNS (watchcat-ui)
• Privilege escalation

David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control

• David-Crty databasement
• Privilege escalation
• Broken access control

immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

• Immich
• Privilege escalation
• Broken access control

Kiteworks Core Local Privilege Escalation

• Kiteworks Core
• Command injection
• Privilege escalation

Kiteworks Core Local Privilege Escalation

• Kiteworks Core
• Path traversal
• Privilege escalation

Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation

• Kiteworks Core
• Path traversal
• Privilege escalation

Kiteworks Core OS Command Injection

• Kiteworks Core
• Command injection
• Privilege escalation

Kiteworks Core Incorrect Privilege Assignment

• Kiteworks Core
• Privilege escalation

Kiteworks Core Privilege Escalation through External Control of File Name or Path

• Kiteworks Core
• Path traversal
• Privilege escalation

Kiteworks Core improper privilege management

• Kiteworks Core
• Privilege escalation

Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

• taskcluster
• Code injection
• Privilege escalation

Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant

• pollen-robotics reachy-mini-os
• Privilege escalation

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

• Zammad
• Privilege escalation

Internet2 Grouper: In Internet2 Grouper before 7.5.1 (in some configurations)…

• Internet2 Grouper
• Privilege escalation

WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability

• SureCart
• Privilege escalation

WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability

• Mahmudul Hasan Arif FluentBoards
• Privilege escalation