A missing authorization vulnerability exists in Webba Plugins Webba Booking (webba-booking-lite) up to version 6.5.4. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A missing authorization vulnerability exists in WPFunnels up to version 3.13.5, allowing exploitation of incorrectly configured access control security levels. This flaw does not require privileges or user interaction and impacts integrity without affecting confidentiality or availability.
A missing authorization vulnerability exists in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce up to version 2.3.24. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized modification of data or settings. The vulnerability has a medium severity rating with a CVSS score of 5.3. No public exploits or patches are currently documented.
A missing authorization vulnerability exists in WPFunnels up to version 3.13.5, allowing exploitation of incorrectly configured access control security levels. This flaw does not impact confidentiality or availability but can lead to integrity issues. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A stored cross-site scripting (XSS) vulnerability exists in bPlugins StreamCast through version 2.4.6 due to improper neutralization of input during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The flaw impacts confidentiality, integrity, and availability to a limited extent. No patch information is currently provided.
Elastic Cloud Enterprise (ECE) suffers from an improper link resolution vulnerability (CWE-59) that allows unauthorized read and write access to data of other deployments on the same host via a symlink attack. This vulnerability can lead to significant confidentiality, integrity, and availability impacts.
A missing authorization vulnerability exists in Brainstorm Force SureForms plugin versions up to 2.12.9. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability does not affect confidentiality or availability but can cause integrity issues.
CVE-2026-115712 is an authorization vulnerability in Elastic Cloud Enterprise (ECE) where an authenticated user with read-only access can improperly modify platform-level settings. This occurs due to insufficient access control enforcement, allowing changes that should be restricted to platform administrators only.
Elastic Cloud Enterprise (ECE) has a vulnerability where sensitive information, including role tokens, is stored in files or directories accessible to lower-privileged platform components. This can allow an attacker with internal access to retrieve these secrets and potentially add unauthorized hosts with elevated roles. The vulnerability is identified as CWE-538 and has a CVSS score of 6.4, indicating a medium severity.
A missing authorization vulnerability exists in WP Desk Custom Price for WooCommerce (custom-price-for-woocommerce) versions up to 1.1.29. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modifications. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A stored cross-site scripting (XSS) vulnerability exists in the Strong Testimonials plugin by WP Chill, affecting versions up to 3.3.15. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of another user. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A vulnerability in Elastic Cloud Enterprise (ECE) involves insertion of sensitive information into an externally-accessible file or directory. After the ECE certificate rotation procedure, sensitive platform credentials and certificate authority private keys are retained in data accessible by lower-privileged components. An attacker with control over any host in the installation can leverage this to escalate privileges and gain full control of the ECE control plane and managed deployments.
Elastic Cloud Enterprise (ECE) suffers from an improper link resolution vulnerability (CWE-59) that can allow an attacker with high privileges on the host to bypass authentication and make unauthorized configuration changes to other deployments on the same host by exploiting symbolic link (symlink) attacks.
A vulnerability identified as Improper Link Resolution Before File Access (CWE-59) exists in Elastic Cloud Enterprise (ECE). This flaw can allow unauthorized disclosure and loss of data from other deployments on the same host through a symlink attack. The vulnerability has a high severity score of 8.2 CVSS v3.1, indicating significant confidentiality, integrity, and availability impacts. No specific affected versions or patch information are provided.
A vulnerability in Elastic Cloud Enterprise (ECE) allows an attacker who controls any host in the installation to bypass authorization by exploiting a user-controlled key. This can lead to privilege escalation through privilege abuse, granting the attacker credentials reserved for other platform roles. With these credentials, the attacker can gain full control over the ECE control plane and its managed deployments.
A missing authorization vulnerability in Brainstorm Force SureDash (up to version 1.12.3) allows exploitation due to incorrectly configured access control security levels. This flaw permits unauthorized access to certain functionality or data without proper permission checks.
A stored cross-site scripting (XSS) vulnerability exists in PublishPress Authors up to version 4.17.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of another user. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.
CVE-2026-112255 is a vulnerability in OpenText Advanced Authentication Server versions 6.4.0.0 through 6.6.1.0 involving insecure default initialization of a resource. The issue allows excessive allocation due to insecure configuration that permits creation or recreation of Unauthenticated Endpoints without proper network restrictions. The vulnerability is addressed in version 6.6.2.0 by enforcing secure configuration practices, specifically disallowing unauthenticated endpoint creation or restricting it to trusted networks via a non-empty whitelist.
An insecure permission vulnerability exists in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159. This flaw allows unauthorized attackers to create forged holiday or work-time entries by importing specially crafted ICS files.
A stored cross-site scripting (XSS) vulnerability exists in Brainstorm Force SureDash versions up to 1.12.3. This flaw allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.