Base de CVEs

CVE-2026-108812 Média · 6.5 CWE-266 12/10/2026

SEMCMS SEMCMS_User.php user improper authorization

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108795 Média · 4.3 CWE-266 12/10/2026

ZKTeco BioTime System Settings API systemSettings access control

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. Upgrading to version 9.5.6 Build 3623 can resolve this issue. It is advisable to upgrade the affected component.

CVE-2026-108575 Média · 6.3 CWE-266 11/10/2026

BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization

A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolution. The manipulation of the argument api_key leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-62022 Crítica · 9.8 CWE-266 10/10/2026

WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

CVE-2026-39801 Crítica · 9.8 CWE-266 10/10/2026

WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

CVE-2026-96341 Alta · 8.2 CWE-266 10/10/2026

WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

CVE-2026-106610 Crítica · 9.8 CWE-266 10/10/2026

WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.

CVE-2026-106608 Alta · 7.2 CWE-266 10/10/2026

WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.

CVE-2026-96539 Média · 5.6 CWE-266 09/10/2026

WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

CVE-2026-106145 Alta · 7.1 CWE-266 09/10/2026

Privilege Escalation in Telerik Report Server Service-Agent Hub

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.

CVE-2026-95594 Alta · 8.1 CWE-266 06/10/2026

WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.

CVE-2026-48197 Alta · 7.2 CWE-266 06/10/2026

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

CVE-2026-39775 Alta · 8.8 CWE-266 06/10/2026

WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.

CVE-2026-39774 Alta · 8.8 CWE-266 06/10/2026

WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

CVE-2026-39773 Crítica · 10.0 CWE-266 06/10/2026

WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.

CVE-2026-39765 Alta · 7.2 CWE-266 06/10/2026

WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

CVE-2026-39761 Crítica · 9.8 CWE-266 06/10/2026

WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.

CVE-2026-39753 Crítica · 9.8 CWE-266 06/10/2026

WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.

CVE-2026-105070 Alta · 8.8 CWE-266 06/10/2026

WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.

CVE-2026-105058 Alta · 8.8 CWE-266 06/10/2026

WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

CVE-2026-104757 Alta · 7.2 CWE-266 06/10/2026

WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

CVE-2026-104405 Alta · 8.1 CWE-266 06/10/2026

WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

CVE-2026-105621 Média · 5.4 CWE-266 06/10/2026

jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization

A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Performing a manipulation results in improper authorization. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-105611 Baixa · 2.7 CWE-266 06/10/2026

chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization

A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-105610 Média · 4.7 CWE-266 06/10/2026

chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument initPassword results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.