Export limit exceeded: 46487 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46487 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-77143 | 1 Typo3 | 1 Extension "forum" | 2026-08-28 | N/A |
| The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content, without the application confirming ownership. Topic identifiers are visible in the public forum listing, and exploitation requires no privileged access or non-default configuration. | ||||
| CVE-2026-77142 | 1 Typo3 | 1 Extension "industry Directory" | 2026-08-28 | N/A |
| The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it. | ||||
| CVE-2026-77141 | 1 Typo3 | 1 Extension "club Directory" | 2026-08-28 | N/A |
| The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it. | ||||
| CVE-2026-77140 | 1 Typo3 | 1 Extension "telephone Directory" | 2026-08-28 | N/A |
| The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check. | ||||
| CVE-2026-77137 | 1 Typo3 | 1 Extension "forms Export" | 2026-08-28 | N/A |
| The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module. | ||||
| CVE-2026-77134 | 1 Typo3 | 1 Extension "femanager" | 2026-08-28 | N/A |
| The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval. | ||||
| CVE-2026-77133 | 1 Typo3 | 1 Extension "femanager" | 2026-08-28 | N/A |
| The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups. | ||||
| CVE-2026-56092 | 1 Typo3 | 1 Extension "apache Solr For Typo3 - Enterprise Search" | 2026-08-28 | N/A |
| The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages. | ||||
| CVE-2026-17587 | 2 Formulaagile, Wordpress | 2 My Agile Privacy® – Cmp, Cookie Consent & Privacy Tools, Wordpress | 2026-08-28 | 5.3 Medium |
| The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify plugin settings including missing_cookie_shield, cookie_shield_running, cmode_v2_js_on_error, cmode_v2_js_error_code, and cmode_v2_js_error_motivation stored in the plugin's settings key. | ||||
| CVE-2026-77824 | 2 Wordpress, Wpcreatix | 2 Wordpress, Media Sweep – Wordpress Media Cleaner | 2026-08-28 | 4.9 Medium |
| The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-18985 | 1 Drupal | 1 Edit In-place Field | 2026-08-28 | 8.1 High |
| Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1. | ||||
| CVE-2026-16645 | 1 Drupal | 1 Photoswipe - Responsive Javascript Modal Image Gallery | 2026-08-28 | 9.1 Critical |
| Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0. | ||||
| CVE-2026-15365 | 1 Vivo | 1 Kids Mode | 2026-08-28 | N/A |
| A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app. | ||||
| CVE-2026-18884 | 2 Wordpress, Wpgenie | 2 Wordpress, Woocommerce Lottery | 2026-08-28 | 7.5 High |
| The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-80236 | 1 Thinkingsoftware | 1 Efence | 2026-08-28 | 8.2 High |
| Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents. | ||||
| CVE-2026-80348 | 1 Tarscloud | 1 Tarsweb | 2026-08-28 | 8.8 High |
| TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching the supplied application and module name, while its sibling uploadPatchPackage, which only stores the package, does check developer authorization first. The only precondition uploadAndPublish enforces is that the named server is registered, and any registered server in the installation satisfies it. downloadPackage and deletePatchPackage select a package by an unscoped sequential primary key covering every application's uploads, and setPatchPackageDefault changes which package a given application deploys by default. Any authenticated account, including one holding a role scoped to a single unrelated application, can therefore push a package to and trigger its deployment on any server the console manages, retrieve or delete any other application's package, and change which package is deployed by default. | ||||
| CVE-2026-54569 | 1 Senaite | 1 Senaite.core | 2026-08-28 | 9.8 Critical |
| SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in src/bika/lims/jsonapi/update.py, including update, update_many, remove, doActionFor, doActionFor_many, and getusers, do not enforce the senaite.core: Access JSON API permission before resolving attacker-selected objects. In src/bika/lims/jsonapi/init.py, set_fields_from_request passes raw request values for RecordsField and RecordField instances to eval() before field mutator write-permission checks execute. An anonymous attacker can discover the bika_setup object identifier through @@uuid, send a value such as RejectionReasons to /@@API/update, and execute arbitrary Python in the Zope worker before a later mutation failure rolls back ZODB changes. The same unsafe evaluation pattern is present in src/senaite/core/browser/fields/record.py and src/senaite/core/browser/fields/records.py. Successful exploitation can expose or modify laboratory data, files, and accounts and can disrupt the service. | ||||
| CVE-2026-81035 | 1 Midday-ai | 1 Midday | 2026-08-28 | 8.1 High |
| Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls re-checks the same helper and nothing else. The neighbouring procedures that remove or update a member in the same router each resolve the caller's role and refuse the request unless it is owner, so the check exists in the file and is not applied to deletion. Member is the role an invited user receives, so any invitee can remove the team and every record scoped to it, and the deletion enqueues the cleanup job with the stored bank-connection tokens, which the job then uses against the connected providers. The update procedure in the same router carries no role check either. | ||||
| CVE-2026-81284 | 2 Acf Extended, Wordpress | 2 Acf Extended, Wordpress | 2026-08-28 | 4.3 Medium |
| Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions. | ||||
| CVE-2026-81767 | 2 Wordpress, Yalla Ya! | 2 Wordpress, Simple Payment | 2026-08-28 | 7.5 High |
| Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions. | ||||