#cwe-639

共收录 1909 条相关情报。

漏洞预警2026-08-17 发布INFO

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enu...

CVE-2026-75103

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-17 发布MEDIUM

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated us...

CVE-2026-14832

CVE-2026-14832 影响 ShopSmart Loyalty for WooCommerce WordPress 插件（版本至 1.0.0）。该插件存在一个严重的访问控制缺失问题：其电话号查询接口暴露给未认证用户，且没有执行任何授

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-17 发布HIGH

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE30...

CVE-2026-19979

CVE-2026-19979 是 GL.iNet 多款路由器/网关产品中 WebDAV 服务组件存在的一个授权绕过漏洞。受影响设备包括 A1300、AX1800、AXT1800、BE1400、BE3600、BE6500、BE9300、BE1

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-08-17 发布INFO

A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_contact of the componen...

CVE-2026-19966

A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

安全公告2026-08-16 发布INFO

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is...

CVE-2026-12998

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure D

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

漏洞预警2026-08-16 发布INFO

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi...

CVE-2026-12998

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure D

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-08-16 发布INFO

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up...

CVE-2026-12905

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-08-16 发布INFO

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for...

CVE-2026-13358

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Ins

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-08-16 发布INFO

The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is...

CVE-2025-10005

The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

漏洞预警2026-08-16 发布INFO

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and ...

CVE-2026-13358

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Ins

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-16 发布INFO

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet...

CVE-2026-12905

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-16 发布INFO

The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includ...

CVE-2025-10005

The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-15 发布INFO

The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being ...

CVE-2026-16142

The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-08-15 发布INFO

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a...

CVE-2026-74242

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Uni

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

漏洞预警2026-08-14 发布MEDIUM

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notificat...

CVE-2026-74242

CVE-2026-74242 是 Red Hat Quay 中存在的一个信息泄露漏洞。该漏洞源于对通知 UUID 的访问控制不当：任何仓库的管理员只要知道或猜到目标通知的 UUID，就可以读取该通知的配置信息，包括 webhook URL、

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-14 发布INFO

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Re...

CVE-2026-19838

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-08-14 发布INFO

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backen...

CVE-2026-19836

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-08-14 发布INFO

A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Imp...

CVE-2026-19834

A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/custome

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-08-14 发布INFO

Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission ...

CVE-2026-19870

Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-14 发布INFO

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization b...

CVE-2026-19784

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Disciplin

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639