Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
CVE-2026-15989
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up
#cwe-269
共收录 809 条相关情报。
← 返回所有主题An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the creation of an OS account by mani...
CVE-2026-76145
An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator p
A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run o...
CVE-2026-102120
A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution
A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to ...
CVE-2026-102113
A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an
A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to ...
CVE-2026-102112
A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an
Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authentic...
CVE-2026-102093
Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restri
There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission...
CVE-2026-86556
There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can explo
There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information.
CVE-2026-86556
该漏洞编号 CVE-2026-86556，由 NVD 收录，影响中兴 ZTE U30 Air 设备（便携式 5G 随身 Wi-Fi / 移动热点类产品）。漏洞根因是设备在权限控制上的实现不当（improper permission cont
Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute arbitrary code outside the sandbox vi...
CVE-2026-102317
Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to
Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE_EVENT_TRACE`. ...
CVE-2026-102710
Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dis
CVE-2026-102710
CVE-2026-102710
Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dis
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview...
CVE-2026-102676
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
CVE-2026-102676
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6
Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.
CVE-2026-100824
Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.
Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100820
Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and F
Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100807
Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 1
Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100801
Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and
A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller....
CVE-2026-101860
A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::a
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authe...
CVE-2026-12269
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the H
Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported...
CVE-2026-101086
Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing aut