A broken access control vulnerability exists in the TeamViewer DEX Platform (On‑Premises) prior...
CVE-2026-8381
A broken access control vulnerability exists in the TeamViewer DEX Platform (On‑Premises) prior version 9.2. Certain bac
#cwe-862
共收录 4228 条相关情报。
← 返回所有主题The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to...
CVE-2026-9011
The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in al
The Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder plugin for...
CVE-2026-8692
The Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder plugin for WordPress is vulnerable to
The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to t...
CVE-2026-9011
WordPress插件Ditty（Responsive News Tickers, Sliders, and Lists）的所有版本直至3.1.65存在授权绕过漏洞。该漏洞源于插件在AJAX请求处理中未正确验证用户权限。具体来说，`ditt
The Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin...
CVE-2026-8692
该漏洞存在于 WordPress 插件 Vedrixa Forms（用户注册表单、登录表单及拖放式表单构建器）中，影响所有版本至 1.1.1（含）。漏洞成因是插件在验证用户权限时存在缺陷：当处理表单结构覆盖请求时，未能充分验证当前用户是否具
The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin not properly verify...
CVE-2026-8684
MotoPress Hotel Booking插件是WordPress上的一款酒店预订管理插件。在版本6.0.1及之前的所有版本中，存在授权绕过漏洞。该漏洞源于插件未能正确验证用户是否有权限执行操作，导致未认证的攻击者可以通过提供任意预订I
A broken access control vulnerability exists in the TeamViewer DEX Platform (On‑Premises) prior version 9.2. Certain backend API endpoints do not correctly enforce authorization...
CVE-2026-8381
TeamViewer DEX Platform (On-Premises) 版本 9.2 之前存在因访问控制失效引起的安全漏洞。该漏洞源于部分后端 API 端点未能正确实施授权检查，导致低权限认证用户可以执行仅限高权限角色才能执行的操作，并
The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and...
CVE-2026-2518
The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing ca
The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due...
CVE-2026-7249
The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability c
The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the `splw_update_block_options()` and `lwp_clean...
CVE-2026-7249
CVE-2026-7249 是一个影响 WordPress Location Weather 插件（版本 ≤ 3.0.2）的漏洞。该插件存在两个函数（splw_update_block_options() 和 lwp_clean_weath
The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on the 'ultp_install_callback' and 'ultp_...
CVE-2026-2518
The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing ca
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations...
CVE-2026-8237
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns th
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page...
CVE-2026-8238
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the
In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers...
CVE-2026-7879
In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php all
Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate....
CVE-2026-8236
Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating'...
CVE-2026-8239
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms exist
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any message by ID. The ...
CVE-2026-8239
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms exist
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the full content of any conversation message. An unauthentica...
CVE-2026-8238
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message. An unauthenti...
CVE-2026-8237
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns th
Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in t...
CVE-2026-8236
Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system