CVE Vulnerability Catalog

A Missing Authorization vulnerability in the AnyComment plugin (anycomment) allows exploiting incorrectly configured access control security levels. Affects versions up to and including 0.3.6.

The Hide Plugins plugin (hide-plugins) in versions up to and including 1.0.4 contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

The Signature Add-On for Gravity Forms plugin up to version 1.8.6 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The WordPress & WooCommerce Scraper Plugin up to version 1.0.7 has a Server-Side Request Forgery (SSRF) vulnerability. This allows sending requests from the server to internal resources, which can lead to exposure of sensitive information.

The WordPress Coming Soon plugin by BoomDevs (coming-soon-by-boomdevs) up to version 1.0.4 has a vulnerability that exposes sensitive system information to unauthorized control spheres. It allows retrieving embedded sensitive data.

The Easy Upload Files During Checkout plugin up to version 3.0.0 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The Order Cancellation & Returns for WooCommerce plugin (wc-order-cancellation-return) in versions up to and including 1.1.11 contains an Authorization Bypass Through User-Controlled Key vulnerability. It allows exploitation of incorrectly configured access control security levels.

A vulnerability exposing sensitive system information in the Direct Payments WP plugin (direct-payments-wp) allows an unauthorized attacker to retrieve embedded sensitive data. Affects versions up to and including 1.3.2.

The WordPress plugin Direct Payments WP (direct-payments-wp) up to version 1.3.2 has a Missing Authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The regService process, which runs with SYSTEM privileges, applies a Security Descriptor to a device object with no explicitly configured DACL. This condition could allow an attacker to perform unauthorized raw disk operations, which could lead to system disruption (DoS) and exposure of sensitive data, and may facilitate local privilege escalation.

The GS Portfolio for Envato plugin (gs-envato-portfolio) up to version 1.4.2 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The Vireo theme up to version 1.0.24 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The Featured Image Generator plugin up to version 1.3.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. This could enable unauthorized actions in the admin panel.

The AI Content Writing Assistant (All in One) plugin up to version 1.1.7 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. This could enable unauthorized actions in the admin panel.

The History Timeline plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions from n/a through 1.0.6.

The Post Video Players plugin up to version 1.163 contains an exposure of sensitive system information to an unauthorized control sphere vulnerability. It allows retrieving embedded sensitive data.

The WordPress plugin Trash Duplicate and 301 Redirect (trash-duplicate-and-301-redirect) up to version 1.9.1 has a Missing Authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The AI Copilot plugin up to version 1.5.2 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. An attacker can perform operations without proper permissions.

The Sticky Notes for WP Dashboard plugin up to version 1.2.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. This could enable unauthorized operations on the admin dashboard.

Zapora VPN opracowana przez QNO Technology posiada podatność na wstrzykiwanie poleceń systemowych, która pozwala uwierzytelnionym zdalnym atakującym na wstrzykiwanie dowolnych poleceń systemowych i ich wykonanie na serwerze.