All CVEs — page 1091 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
A SQL injection vulnerability in Ultimeter's editor component allows authenticated attackers to execute arbitrary SQL commands against the application's database. This could lead to data theft, unauthorized access to sensitive information, and potential database compromise.
A SQL injection vulnerability in Easy Digital Downloads plugin allows authenticated shop managers to execute arbitrary database queries, potentially leading to data exposure or manipulation. This is particularly concerning because shop managers often have elevated privileges within e-commerce systems.
This vulnerability allows unauthenticated users to bypass access controls in the WordPress calendar plugin, potentially enabling unauthorized modifications to scheduling data. The flaw stems from missing authentication checks that should have protected critical administrative functions.
The flaw is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in PublishPress Capabilities versions up to 2.50.1, allowing attackers to perform actions on behalf of authenticated users without their consent.