Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVEs (10,068)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-23882 1Brainstormforce 1Ultimate Addons For Beaver Builder Jun 17, 2026 Jan 17, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite.This issue affects Ultimate Addons for Beaver Builder – Lite: from n/a through 1.5.5.
CVE-2022-41695 1Sedlex 1Traffic Manager Jun 17, 2026 Jan 17, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5.
CVE-2022-41619 1Sedlex 1Image Zoom Jun 17, 2026 Jan 17, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8.
CVE-2022-40702 1Zorem 1Advanced Local Pickup For Woocommerce Jun 17, 2026 Jan 17, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.5.2.
CVE-2023-34379 1Magneticone 1Magento To Woocommerce Migration Jun 17, 2026 Jan 17, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in MagneticOne Cart2Cart: Magento to WooCommerce Migration.This issue affects Cart2Cart: Magento to WooCommerce Migration: from n/a through 2.0.0.
CVE-2022-40203 1Algolplus 1Advanced Dynamic Pricing For Woocommerce Jun 17, 2026 Jan 17, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Missing Authorization vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through 4.1.5.
CVE-2022-38141 1Zorem 1Sales Report Email For Woocommerce Jun 17, 2026 Jan 17, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.This issue affects Sales Report Email for WooCommerce: from n/a through 2.8.
CVE-2022-36418 1Dcgws 1Hreflang Tags Lite Jun 17, 2026 Jan 17, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Missing Authorization vulnerability in Vagary Digital HREFLANG Tags Lite.This issue affects HREFLANG Tags Lite: from n/a through 2.0.0.
CVE-2023-48926 1Prestashop 1Advanced Loyalty Program Jun 17, 2026 Jan 16, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status.
CVE-2024-0238 1Myeventon 1Eventon Jun 17, 2026 Jan 16, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthe...Show more The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthenticated users to update arbitrary post metadata.Show less
CVE-2024-0237 1Myeventon 1Eventon Jun 17, 2026 Jan 16, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated users to update virtual events settings, such as meeting URL, mod...Show more The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated users to update virtual events settings, such as meeting URL, moderator, access details etcShow less
CVE-2024-0236 1Myeventon 1Eventon Jun 17, 2026 Jan 16, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtual events, including...Show more The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtual events, including any meeting password set (for example for Zoom)Show less
CVE-2024-0235 1Myeventon 1Eventon Jun 17, 2026 Jan 16, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog
CVE-2022-23180 1Themehunk 1Contact Form & Lead Form Elementor Builder Jun 17, 2026 Jan 16, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various setting...Show more The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settingsShow less
CVE-2024-0570 1Totolink 1N350rt Firmware Jun 17, 2026 Jan 16, 2024 6.9 MEDIUM· v4 9.1 CRITICAL· v3 7.5 HIGH· v2 A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6265. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation leads to improp...Show more A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6265. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. It is recommended to upgrade the affected component. VDB-250786 is the identifier assigned to this vulnerability.Show less
CVE-2024-0569 1Totolink 1T8 Firmware Jun 17, 2026 Jan 16, 2024 5.3 MEDIUM· v4 9.1 CRITICAL· v3 4.0 MEDIUM· v2 A vulnerability classified as problematic has been found in Totolink T8 4.1.5cu.833_20220905. This affects the function getSysStatusCfg of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation...Show more A vulnerability classified as problematic has been found in Totolink T8 4.1.5cu.833_20220905. This affects the function getSysStatusCfg of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument ssid/key leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.5cu.862_B20230228 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-250785 was assigned to this vulnerability.Show less
CVE-2023-34063 1Vmware 2Aria Automation Cloud Foundation Jun 17, 2026 Jan 16, 2024 N/A· v4 8.3 HIGH· v3 N/A· v2 Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows.
CVE-2023-6066 1Kishorkhambu 1Wp Custom Widget Area Jun 17, 2026 Jan 15, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create,...Show more The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site.Show less
CVE-2023-6048 1Estatik 1Estatik Jun 17, 2026 Jan 15, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and le...Show more The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are resetShow less
CVE-2023-6029 1Spider Themes 1Eazydocs Jun 17, 2026 Jan 15, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitra...Show more The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections.Show less

Previous 1...390391392...504 Next