A missing authorization vulnerability exists in Webba Plugins Webba Booking (webba-booking-lite) up to version 6.5.4. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A missing authorization vulnerability exists in WPFunnels up to version 3.13.5, allowing exploitation of incorrectly configured access control security levels. This flaw does not require privileges or user interaction and impacts integrity without affecting confidentiality or availability.
A missing authorization vulnerability exists in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce up to version 2.3.24. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized modification of data or settings. The vulnerability has a medium severity rating with a CVSS score of 5.3. No public exploits or patches are currently documented.
A missing authorization vulnerability exists in WPFunnels up to version 3.13.5, allowing exploitation of incorrectly configured access control security levels. This flaw does not impact confidentiality or availability but can lead to integrity issues. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A stored cross-site scripting (XSS) vulnerability exists in bPlugins StreamCast through version 2.4.6 due to improper neutralization of input during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The flaw impacts confidentiality, integrity, and availability to a limited extent. No patch information is currently provided.
Elastic Cloud Enterprise (ECE) suffers from an improper link resolution vulnerability (CWE-59) that allows unauthorized read and write access to data of other deployments on the same host via a symlink attack. This vulnerability can lead to significant confidentiality, integrity, and availability impacts.
A missing authorization vulnerability exists in Brainstorm Force SureForms plugin versions up to 2.12.9. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability does not affect confidentiality or availability but can cause integrity issues.
CVE-2026-115712 is an authorization vulnerability in Elastic Cloud Enterprise (ECE) where an authenticated user with read-only access can improperly modify platform-level settings. This occurs due to insufficient access control enforcement, allowing changes that should be restricted to platform administrators only.
Elastic Cloud Enterprise (ECE) has a vulnerability where sensitive information, including role tokens, is stored in files or directories accessible to lower-privileged platform components. This can allow an attacker with internal access to retrieve these secrets and potentially add unauthorized hosts with elevated roles. The vulnerability is identified as CWE-538 and has a CVSS score of 6.4, indicating a medium severity.
A missing authorization vulnerability exists in WP Desk Custom Price for WooCommerce (custom-price-for-woocommerce) versions up to 1.1.29. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modifications. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A stored cross-site scripting (XSS) vulnerability exists in the Strong Testimonials plugin by WP Chill, affecting versions up to 3.3.15. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of another user. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A vulnerability in Elastic Cloud Enterprise (ECE) involves insertion of sensitive information into an externally-accessible file or directory. After the ECE certificate rotation procedure, sensitive platform credentials and certificate authority private keys are retained in data accessible by lower-privileged components. An attacker with control over any host in the installation can leverage this to escalate privileges and gain full control of the ECE control plane and managed deployments.
Elastic Cloud Enterprise (ECE) suffers from an improper link resolution vulnerability (CWE-59) that can allow an attacker with high privileges on the host to bypass authentication and make unauthorized configuration changes to other deployments on the same host by exploiting symbolic link (symlink) attacks.
A vulnerability identified as Improper Link Resolution Before File Access (CWE-59) exists in Elastic Cloud Enterprise (ECE). This flaw can allow unauthorized disclosure and loss of data from other deployments on the same host through a symlink attack. The vulnerability has a high severity score of 8.2 CVSS v3.1, indicating significant confidentiality, integrity, and availability impacts. No specific affected versions or patch information are provided.
A vulnerability in Elastic Cloud Enterprise (ECE) allows an attacker who controls any host in the installation to bypass authorization by exploiting a user-controlled key. This can lead to privilege escalation through privilege abuse, granting the attacker credentials reserved for other platform roles. With these credentials, the attacker can gain full control over the ECE control plane and its managed deployments.
A missing authorization vulnerability in Brainstorm Force SureDash (up to version 1.12.3) allows exploitation due to incorrectly configured access control security levels. This flaw permits unauthorized access to certain functionality or data without proper permission checks.
A stored cross-site scripting (XSS) vulnerability exists in PublishPress Authors up to version 4.17.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of another user. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.
This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.
The fix for this is issue is to create a secure configuration. The 6.6.2.0 release has a best practice entry if the configuration is unsecure.
A secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints. If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.
To remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks. An empty whitelist will allow all networks to create/recreate endpoints.
Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.