All CVEs — page 270 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
This flaw allows unauthenticated attackers to store a serialized PHP object, leading to potential arbitrary file deletion, sensitive data disclosure, or remote code execution if a suitable PHP Object Persistence (POP) chain is present.
The flaw allows any authenticated user to grant themselves the Administrator role without proper role validation, enabling unauthorized administrative access.
The Nexi XPay WordPress plugin fails to validate security tokens on its payment notification endpoint, allowing unauthenticated attackers to mark any order as paid or failed by exploiting a missing token validation check.
The Nexi XPay Build WordPress plugin fails to verify payment results in unauthenticated routes, allowing attackers to manipulate order statuses and access guest buyer details without authentication.