Total
4834 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-47560 | 2025-05-19 | N/A | 5.0 MEDIUM | ||
| Missing Authorization vulnerability in RomanCode MapSVG allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MapSVG: from n/a through 8.5.32. | |||||
| CVE-2025-31923 | 2025-05-19 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CSS3 Accordions for WordPress: from n/a through 3.0. | |||||
| CVE-2025-47564 | 2025-05-19 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in ashanjay EventON allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EventON: from n/a through 4.9.9. | |||||
| CVE-2025-39511 | 2025-05-19 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pinterest Automatic Pin: from n/a through 4.18.2. | |||||
| CVE-2025-47556 | 2025-05-19 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a through 11.5. | |||||
| CVE-2025-47534 | 2025-05-19 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Wordpress Auto Spinner: from n/a through 3.25.0. | |||||
| CVE-2025-31065 | 2025-05-19 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: from n/a through 1.4. | |||||
| CVE-2025-48117 | 2025-05-19 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in kilbot WooCommerce POS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce POS: from n/a through 1.7.8. | |||||
| CVE-2025-48127 | 2025-05-19 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Push notification for Mobile and Web app: from n/a through 2.0.3. | |||||
| CVE-2025-4477 | 2025-05-19 | N/A | 7.2 HIGH | ||
| The ThreatSonar Anti-Ransomware from TeamT5 has a Privilege Escalation vulnerability, allowing remote attackers with intermediate privileges to escalate their privileges to highest administrator level through a specific API. | |||||
| CVE-2025-48128 | 2025-05-19 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sharespine Woocommerce Connector: from n/a through 4.7.55. | |||||
| CVE-2025-48116 | 2025-05-19 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Ashan Perera EventON allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EventON: from n/a through 2.4.4. | |||||
| CVE-2025-3952 | 1 Projectopia | 1 Projectopia | 2025-05-19 | N/A | 8.1 HIGH |
| The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'pto_remove_logo' function in all versions up to, and including, 5.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users. | |||||
| CVE-2024-10008 | 1 Masteriyo | 1 Masteriyo | 2025-05-17 | N/A | 8.8 HIGH |
| The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students. | |||||
| CVE-2024-36036 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2025-05-16 | N/A | 4.2 MEDIUM |
| Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and modifying the agent configuration. | |||||
| CVE-2025-39413 | 1 Wpgoplugins | 1 Simple Sitemap | 2025-05-16 | N/A | 4.3 MEDIUM |
| Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through 3.5.14. | |||||
| CVE-2025-4430 | 2025-05-16 | N/A | N/A | ||
| Unauthorized access to "/api/Token/gettoken" endpoint in EZD RP allows file manipulation.This issue affects EZD RP in versions before 20.19 (published on 22nd August 2024). | |||||
| CVE-2025-24021 | 2025-05-16 | N/A | 5.0 MEDIUM | ||
| iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue. | |||||
| CVE-2025-4520 | 2025-05-16 | N/A | 5.4 MEDIUM | ||
| The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings. | |||||
| CVE-2024-58101 | 2025-05-16 | N/A | 8.1 HIGH | ||
| Samsung Galaxy Buds and Galaxy Buds 2 audio devices are Bluetooth pairable by default without user input nor a way to stop this mode. As a consequence, audio playback takeover or even microphone recording without user consent or notification is achieved. Note: This is considered a low severity vulnerability by the vendor. | |||||