The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to...
CVE-2026-14311
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and
#cwe-862
共收录 4087 条相关情报。
← 返回所有主题The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to...
CVE-2026-16582
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modificatio
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in ...
CVE-2026-54671
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource arra
CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and do not require CC_P...
CVE-2026-54648
CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely
CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note ...
CVE-2026-54643
CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.ph
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicalda...
CVE-2026-54608
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/Syste
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js au...
CVE-2026-54519
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer...
CVE-2026-16750
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of da
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. Th...
CVE-2026-16582
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modificatio
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verificat...
CVE-2026-14311
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote...
CVE-2026-93378
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised t
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected...
CVE-2026-92992
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown functio
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafte...
CVE-2026-93378
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised t
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.php after installati...
CVE-2026-54237
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /instal
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
CVE-2026-75837
## Summary The core Flex group blueprint `system/blueprints/user/group.yaml` (access field, lines 48-55) omits the `secu
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the compone...
CVE-2026-92992
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown functio
Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial...
CVE-2026-49292
Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBV
Dromara mayfly-go AI Assistant ai.go authorization
CVE-2026-92992
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown functio
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging...
CVE-2026-54677
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot acc...
CVE-2026-54676
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve