Total
4582 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-32213 | 2025-04-11 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in flothemesplugins Flo Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Flo Forms: from n/a through 1.0.43. | |||||
| CVE-2025-32216 | 2025-04-11 | N/A | 6.4 MEDIUM | ||
| Missing Authorization vulnerability in Spider Themes Spider Elements – Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Spider Elements – Addons for Elementor: from n/a through 1.6.2. | |||||
| CVE-2025-32212 | 2025-04-11 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Specia Theme Specia Companion allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Specia Companion: from n/a through 4.6. | |||||
| CVE-2025-32242 | 2025-04-11 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Hive Support Hive Support allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Hive Support: from n/a through 1.2.2. | |||||
| CVE-2025-32243 | 2025-04-11 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Toast Plugins Internal Link Optimiser allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Internal Link Optimiser: from n/a through 5.1.2. | |||||
| CVE-2025-32208 | 2025-04-11 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Hive Support Hive Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hive Support: from n/a through 1.2.2. | |||||
| CVE-2024-37255 | 1 Wpmet | 1 Elements Kit Elementor Addons | 2025-04-11 | N/A | 5.3 MEDIUM |
| Missing Authorization vulnerability in Wpmet Elements kit Elementor addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Elements kit Elementor addons: from n/a through 3.1.4. | |||||
| CVE-2022-45819 | 1 Code-atlantic | 1 Popup Maker | 2025-04-11 | N/A | 3.5 LOW |
| Missing Authorization vulnerability in Popup Maker Popup Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Maker: from n/a through 1.17.1. | |||||
| CVE-2022-45826 | 1 Sunshinephotocart | 1 Sunshine Photo Cart | 2025-04-11 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 2.9.13. | |||||
| CVE-2022-47594 | 1 Wpdeveloper | 1 Essential Blocks | 2025-04-11 | N/A | 6.5 MEDIUM |
| Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 3.8.5. | |||||
| CVE-2021-35001 | 1 Bmc | 1 Track-it\! | 2025-04-11 | N/A | 6.5 MEDIUM |
| BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetData endpoint. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-14527. | |||||
| CVE-2025-32220 | 1 Salonbookingsystem | 1 Salon Booking System | 2025-04-11 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in Dimitri Grassi Salon booking system allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Salon booking system: from n/a through 10.10.7. | |||||
| CVE-2012-4245 | 1 Gimp | 1 Gimp | 2025-04-11 | 6.8 MEDIUM | N/A |
| The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the python-fu-eval command. | |||||
| CVE-2024-7031 | 1 Ninjateam | 1 Filester | 2025-04-10 | N/A | 7.5 HIGH |
| The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as .php to be uploaded. | |||||
| CVE-2025-26378 | 1 Q-free | 1 Maxtime | 2025-04-10 | N/A | 8.8 HIGH |
| A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests. | |||||
| CVE-2025-26367 | 1 Q-free | 1 Maxtime | 2025-04-10 | N/A | 4.3 MEDIUM |
| A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to create arbitrary user groups via crafted HTTP requests. | |||||
| CVE-2025-26371 | 1 Q-free | 1 Maxtime | 2025-04-10 | N/A | 8.8 HIGH |
| A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to add users to groups via crafted HTTP requests. | |||||
| CVE-2025-26376 | 1 Q-free | 1 Maxtime | 2025-04-10 | N/A | 6.5 MEDIUM |
| A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to modify user data via crafted HTTP requests. | |||||
| CVE-2024-33914 | 1 Exclusiveaddons | 1 Exclusive Addons For Elementor | 2025-04-10 | N/A | 4.3 MEDIUM |
| Missing Authorization vulnerability in Exclusive Addons Exclusive Addons Elementor.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.1. | |||||
| CVE-2022-44437 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2025-04-10 | N/A | 5.5 MEDIUM |
| In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed. | |||||