CWE-862: Missing Authorization

NVIDIA AIStore has an authentication vulnerability (CWE-862: Missing Authorization) that allows unauthenticated attackers to access sensitive informat...

The Find Unused Images WordPress plugin has an authorization bypass vulnerability that allows unauthenticated attackers to delete all image attachment...

The Add Multiple Marker WordPress plugin has missing capability checks in two functions, allowing unauthenticated attackers to reset maps and update m...

The Course Booking System WordPress plugin allows unauthenticated attackers to directly access a CSV export file and download all booking data. This a...

kgateway versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication on the xDS port, allowing any client with network acce...

This CVE describes a missing authorization vulnerability in the Kallyas WordPress theme that allows unauthorized users to access functionality or data...

This CVE describes a Missing Authorization vulnerability in the Jthemes imEvent WordPress theme that allows attackers to access functionality not prop...

This vulnerability in the Paid Membership Subscriptions WordPress plugin allows unauthenticated attackers to trigger stored auto-renew charges for arb...

The DominoKit WordPress plugin has an authentication bypass vulnerability that allows unauthenticated attackers to modify plugin settings via an AJAX ...

The Simple User Capabilities WordPress plugin has an authentication bypass vulnerability that allows unauthenticated attackers to reset any user's cap...

This CVE describes a missing authorization vulnerability in the WP Snow Effect WordPress plugin that allows attackers to dismiss admin notices without...

This vulnerability in the WP Legal Pages WordPress plugin allows unauthenticated attackers to disconnect a WordPress site from its API plan by exploit...

The ERI File Library WordPress plugin up to version 1.1.0 has an authorization bypass vulnerability that allows unauthenticated attackers to download ...

The RealPress WordPress plugin before version 1.1.0 has missing authorization checks in its REST API endpoints. This allows unauthenticated attackers ...

This CVE describes a missing authorization vulnerability in the Masterstudy Elementor Widgets WordPress plugin that allows attackers to access functio...

This CVE describes a missing authorization vulnerability in the WpEstate wpresidence WordPress theme that allows attackers to bypass access controls. ...

This CVE describes a missing authorization vulnerability in the solwin Blog Designer PRO WordPress plugin that allows attackers to access functionalit...

This CVE describes a missing authorization vulnerability in Facebook for WooCommerce plugin that allows attackers to exploit incorrectly configured ac...

This CVE describes a missing authorization vulnerability in the Joovii Sendle Shipping WordPress plugin that allows attackers to access functionality ...

This CVE describes a Missing Authorization vulnerability in the 沃之涛 百度站长SEO合集 WordPress plugin (also known as baiduseo). It allows a...

This CVE describes a Missing Authorization vulnerability in the Link Whisper Free WordPress plugin that allows attackers to bypass access controls. It...

This CVE describes a missing authorization vulnerability in the BuddyForms WordPress plugin that allows attackers to access functionality not properly...

This vulnerability allows unauthorized users to access administrative functionality in the Coupon Affiliates WordPress plugin. Attackers can exploit m...

The Social Feed Gallery WordPress plugin versions ≤4.9.2 have an authorization bypass vulnerability that allows unauthenticated attackers to access ...

The Product Filter by WBW WordPress plugin up to version 3.0.0 has a missing capability check on the 'approveNotice' action, allowing unauthenticated ...

This vulnerability in Tutor LMS WordPress plugin allows unauthenticated attackers to bypass payment verification by forging webhook requests with 'rec...

This vulnerability allows unauthenticated attackers to access the User Feedback plugin's onboarding wizard page in WordPress, exposing configuration i...

The BackWPup WordPress plugin up to version 5.5.0 has an authorization vulnerability where authenticated users with Subscriber-level access or higher ...

This vulnerability allows remote attackers to access Liferay's OpenAPI YAML file through a crafted URL, potentially exposing API documentation and int...

This CVE describes a missing authorization vulnerability in the CoSchedule WordPress plugin that allows attackers to bypass access controls. Attackers...

This vulnerability allows unauthorized users to access functionality that should be restricted by proper access controls in the Whydonate WordPress pl...

This CVE describes a Missing Authorization vulnerability in the StellarWP WPComplete plugin for WordPress that allows attackers to access functionalit...

The Zip Attachments plugin for WordPress has an authorization vulnerability that allows unauthenticated attackers to delete arbitrary files from the W...

The Zip Attachments plugin for WordPress has an authorization bypass vulnerability that allows unauthenticated attackers to download attachments from ...

The YourMembership SSO Login WordPress plugin has an authorization vulnerability that allows unauthenticated attackers to access profile data from the...

This vulnerability allows unauthenticated attackers to delete data from the WhyDonate WordPress plugin's database table. It affects all WordPress site...

PowerJob versions up to 5.1.2 have an authorization bypass vulnerability in the OpenAPIController's /openApi/runJob endpoint. This allows remote attac...

PowerJob versions up to 5.1.2 have a missing authorization vulnerability in the /user/list endpoint that allows unauthorized access to user informatio...

This CVE describes a missing authorization vulnerability in the WP Virtual Assistant WordPress plugin that allows attackers to bypass intended access ...

This CVE describes a Missing Authorization vulnerability in the Yext WordPress plugin that allows attackers to access functionality not properly restr...

This CVE describes a missing authorization vulnerability in the WEDOS Global WordPress plugin that allows attackers to access functionality not proper...

This CVE describes a missing authorization vulnerability in the WP Directory Kit WordPress plugin that allows attackers to bypass access controls. It ...

A missing authorization vulnerability in Ex-Themes WooEvents WordPress plugin allows attackers to bypass intended access controls. This affects all Wo...

This CVE describes a Missing Authorization vulnerability in the guihom Wide Banner WordPress plugin that allows attackers to bypass access controls. A...

The Featured Image from URL (FIFU) WordPress plugin has an authorization bypass vulnerability that allows unauthenticated attackers to read private an...

This CVE describes a missing authorization vulnerability in the WordPress Custom Login URL plugin that allows attackers to bypass intended access cont...

This CVE describes a Missing Authorization vulnerability in the Cecabank WooCommerce Plugin for WordPress. It allows attackers to exploit incorrectly ...

This CVE describes a Missing Authorization vulnerability in the AppMySite WordPress plugin that allows attackers to bypass access controls. It affects...

This CVE describes a Missing Authorization vulnerability in the Easy Quotes WordPress plugin that allows attackers to bypass intended access controls....

This CVE describes a missing authorization vulnerability in the TI WooCommerce Wishlist WordPress plugin that allows attackers to bypass access contro...