Common Weakness Enumeration
CWE-266
AllowedIncorrect Privilege Assignment
Abstraction: Base · Status: Draft
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
1235 vulnerabilities reference this CWE, most recent first.
CVE-2026-114245 (GCVE-0-2026-114245)
Vulnerability from cvelistv5 – Published: 2026-10-21 12:45 – Updated: 2026-10-21 15:48
VLAI
EPSS
VEX
Title
dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization
Summary
A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form. Executing a manipulation of the argument submit/Admin_id/password can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 15:45 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424679 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424679/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114245 | third-party-advisory |
| https://vuldb.com/submit/1018588 | third-party-advisory |
| https://github.com/dhikshitha29/Insurance-Managem… | exploitissue-tracking |
| https://github.com/dhikshitha29/Insurance-Managem… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dhikshitha29 | Insurance-Management-System |
Affected:
91de5edda5baa109ad8e9baf03ce6a3ceda84183
Affected: 125362cc21dca20d74091a4913a5096bb58dd837 cpe:2.3:a:dhikshitha29:insurance-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114245",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T15:45:09.471314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:48:13.141Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dhikshitha29:insurance-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Add New Admin Form"
],
"product": "Insurance-Management-System",
"vendor": "dhikshitha29",
"versions": [
{
"status": "affected",
"version": "91de5edda5baa109ad8e9baf03ce6a3ceda84183"
},
{
"status": "affected",
"version": "125362cc21dca20d74091a4913a5096bb58dd837"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "TypeThe0ry (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form. Executing a manipulation of the argument submit/Admin_id/password can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:14.392Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424679 | dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424679"
},
{
"name": "VDB-424679 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424679/cti"
},
{
"name": "CVE-2026-114245 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114245"
},
{
"name": "Submit #1018588 | dhikshitha29 Insurance-Management-System 125362cc21dca20d74091a4913a5096bb58dd837 Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018588"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/dhikshitha29/Insurance-Management-System/issues/4"
},
{
"tags": [
"product"
],
"url": "https://github.com/dhikshitha29/Insurance-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T08:59:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114245",
"datePublished": "2026-10-21T12:45:14.392Z",
"dateReserved": "2026-10-21T06:50:26.495Z",
"dateUpdated": "2026-10-21T15:48:13.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114233 (GCVE-0-2026-114233)
Vulnerability from cvelistv5 – Published: 2026-11-05 13:35 – Updated: 2026-11-05 13:35
VLAI
EPSS
VEX
Title
Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders
Summary
Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShipInfo and appendOrderItem services. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Severity
No CVSS data available.
CWE
- CWE-266 - Incorrect privilege assignment
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/7b2syzksp7kl… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache OFBiz |
Affected:
0 , < 24.09.08
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache OFBiz",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "24.09.08",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Javier Garc\u00eda Herrera of Muted Cybersecurity"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Privilege Assignment in the Order Manager in Apache OFBiz\u0026nbsp;24.09 before 24.09.08\u0026nbsp;on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group\u0027s shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShipInfo and appendOrderItem services. Users are recommended to upgrade to version\u0026nbsp;24.09.08, which fixes this issue."
}
],
"value": "Incorrect Privilege Assignment in the Order Manager in Apache OFBiz\u00a024.09 before 24.09.08\u00a0on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group\u0027s shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShipInfo and appendOrderItem services. Users are recommended to upgrade to version\u00a024.09.08, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect privilege assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T13:35:47.683Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-114233",
"datePublished": "2026-11-05T13:35:47.683Z",
"dateReserved": "2026-10-21T06:19:28.896Z",
"dateUpdated": "2026-11-05T13:35:47.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113507 (GCVE-0-2026-113507)
Vulnerability from cvelistv5 – Published: 2026-10-20 17:30 – Updated: 2026-10-23 01:57
VLAI
EPSS
VEX
Title
aaPanel common.py GetClientIp access control
Summary
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 01:56 UTC
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422749 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422749/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113507 | third-party-advisory |
| https://vuldb.com/submit/996821 | third-party-advisory |
| https://github.com/JdExploit/aapanel-cve-2026/tre… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | aaPanel |
Affected:
8.0
Affected: 8.1 Affected: 8.2 Affected: 8.3 Affected: 8.4 Affected: 8.5 Affected: 8.6 Affected: 8.7 Affected: 8.8 Affected: 8.9 Affected: 8.10 Affected: 8.11 Affected: 8.12 Affected: 8.13 Affected: 8.14 Affected: 8.15 Affected: 8.16 Affected: 8.17 Affected: 8.18 Affected: 8.19 Affected: 8.20 Affected: 8.21 Affected: 8.22 Affected: 8.23 Affected: 8.24 Affected: 8.25.0 cpe:2.3:a:aapanel:aapanel:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113507",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T01:56:54.679976Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T01:57:09.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:aapanel:aapanel:*:*:*:*:*:*:*:*"
],
"product": "aaPanel",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "8.0"
},
{
"status": "affected",
"version": "8.1"
},
{
"status": "affected",
"version": "8.2"
},
{
"status": "affected",
"version": "8.3"
},
{
"status": "affected",
"version": "8.4"
},
{
"status": "affected",
"version": "8.5"
},
{
"status": "affected",
"version": "8.6"
},
{
"status": "affected",
"version": "8.7"
},
{
"status": "affected",
"version": "8.8"
},
{
"status": "affected",
"version": "8.9"
},
{
"status": "affected",
"version": "8.10"
},
{
"status": "affected",
"version": "8.11"
},
{
"status": "affected",
"version": "8.12"
},
{
"status": "affected",
"version": "8.13"
},
{
"status": "affected",
"version": "8.14"
},
{
"status": "affected",
"version": "8.15"
},
{
"status": "affected",
"version": "8.16"
},
{
"status": "affected",
"version": "8.17"
},
{
"status": "affected",
"version": "8.18"
},
{
"status": "affected",
"version": "8.19"
},
{
"status": "affected",
"version": "8.20"
},
{
"status": "affected",
"version": "8.21"
},
{
"status": "affected",
"version": "8.22"
},
{
"status": "affected",
"version": "8.23"
},
{
"status": "affected",
"version": "8.24"
},
{
"status": "affected",
"version": "8.25.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jdexploit (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: \"The reported X-Real-Ip IP-bypass vulnerability has already been fixed\"."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:30:15.196Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422749 | aaPanel common.py GetClientIp access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422749"
},
{
"name": "VDB-422749 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422749/cti"
},
{
"name": "CVE-2026-113507 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113507"
},
{
"name": "Submit #996821 | aaPanel aaPanel Linux Panel v8.22.0 (GitHub commit 4af59b2386e118fc0e4b2ae838dacac992d16b1c, 2026-08-27) Improper Validation of Input Trusted in Security Decision",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/996821"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-xrealip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T12:58:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "aaPanel common.py GetClientIp access control",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113507",
"datePublished": "2026-10-20T17:30:15.196Z",
"dateReserved": "2026-10-20T10:53:30.529Z",
"dateUpdated": "2026-10-23T01:57:09.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112407 (GCVE-0-2026-112407)
Vulnerability from cvelistv5 – Published: 2026-10-20 20:34 – Updated: 2026-10-28 20:04
VLAI
EPSS
VEX
Title
Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications
Summary
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.
To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 17:53 UTC
CWE
- CWE-266 - Incorrect privilege assignment
Assigner
AMZN
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/aws-samples/aws-lambda-sample-… | release-notespatch |
| https://github.com/aws-samples/aws-lambda-sample-… | third-party-advisory |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AWS | CICD-toolchain-for-serverless-applications |
Affected:
1.0.7 , ≤ 1.0.10
(custom)
cpe:2.3:a:aws:cicd-toolchain-for-serverless-applications:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112407",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T17:53:21.671145Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T20:04:37.868Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CICD-toolchain-for-serverless-applications",
"vendor": "AWS",
"versions": [
{
"lessThanOrEqual": "1.0.10",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aws:cicd-toolchain-for-serverless-applications:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.10",
"versionStartIncluding": "1.0.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Xidian University"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.\u003c/p\u003e"
}
],
"value": "Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.\n\n\n\nTo remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect privilege assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T20:34:40.192Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/aws-samples/aws-lambda-sample-applications/releases/tag/1.0.11"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/aws-samples/aws-lambda-sample-applications/security/advisories/GHSA-f76m-4xrx-pvq5"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-141-aws/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-112407",
"datePublished": "2026-10-20T20:34:40.192Z",
"dateReserved": "2026-10-19T17:00:34.859Z",
"dateUpdated": "2026-10-28T20:04:37.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112242 (GCVE-0-2026-112242)
Vulnerability from cvelistv5 – Published: 2026-10-22 08:00 – Updated: 2026-10-25 22:47 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability
Summary
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 10:48 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cozmoslabs | Profile Builder |
Affected:
0 , ≤ 4.0.4
(custom)
|
Date Public
2026-10-20 07:01
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112242",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T10:48:31.273014Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:56:14.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "profile-builder",
"product": "Profile Builder",
"vendor": "Cozmoslabs",
"versions": [
{
"changes": [
{
"at": "4.0.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jamir0qai | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-20T07:01:29.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.\u003cp\u003eThis issue affects Profile Builder: from n/a through 4.0.4.\u003c/p\u003e"
}
],
"value": "Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T22:47:02.391Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/profile-builder/vulnerability/wordpress-profile-builder-plugin-4-0-4-privilege-escalation-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Profile Builder plugin to the latest available version (at least 4.0.5)."
}
],
"value": "Update the WordPress Profile Builder plugin to the latest available version (at least 4.0.5)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Profile Builder plugin \u003c= 4.0.4 - Privilege Escalation vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-112242",
"datePublished": "2026-10-22T08:00:49.604Z",
"dateReserved": "2026-10-19T12:18:24.536Z",
"dateUpdated": "2026-10-25T22:47:02.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112045 (GCVE-0-2026-112045)
Vulnerability from cvelistv5 – Published: 2026-10-19 03:00 – Updated: 2026-10-19 17:41
VLAI
EPSS
VEX
Title
donetick History Deletion model.go CanDeleteHistory improper authorization
Summary
A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: "The concerns about "IDOR" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:41 UTC
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421693 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421693/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112045 | third-party-advisory |
| https://vuldb.com/submit/1009027 | third-party-advisory |
| https://github.com/donetick/donetick/issues/711 | exploitissue-tracking |
| https://github.com/donetick/donetick/security/adv… | broken-link |
| https://github.com/donetick/donetick/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | donetick |
Affected:
0.1.0
Affected: 0.1.1 Affected: 0.1.2 Affected: 0.1.3 Affected: 0.1.4 Affected: 0.1.5 Affected: 0.1.6 Affected: 0.1.7 Affected: 0.1.8 Affected: 0.1.9 Affected: 0.1.10 Affected: 0.1.11 Affected: 0.1.12 Affected: 0.1.13 Affected: 0.1.14 Affected: 0.1.15 Affected: 0.1.16 Affected: 0.1.17 Affected: 0.1.18 Affected: 0.1.19 Affected: 0.1.20 Affected: 0.1.21 Affected: 0.1.22 Affected: 0.1.23 Affected: 0.1.24 Affected: 0.1.25 Affected: 0.1.26 Affected: 0.1.27 Affected: 0.1.28 Affected: 0.1.29 Affected: 0.1.30 Affected: 0.1.31 Affected: 0.1.32 Affected: 0.1.33 Affected: 0.1.34 Affected: 0.1.35 Affected: 0.1.36 Affected: 0.1.37 Affected: 0.1.38 Affected: 0.1.39 Affected: 0.1.40 Affected: 0.1.41 Affected: 0.1.42 Affected: 0.1.43 Affected: 0.1.44 Affected: 0.1.45 Affected: 0.1.46 Affected: 0.1.47 Affected: 0.1.48 Affected: 0.1.49 Affected: 0.1.50 Affected: 0.1.51 Affected: 0.1.52 Affected: 0.1.53 Affected: 0.1.54 Affected: 0.1.55 Affected: 0.1.56 Affected: 0.1.57 Affected: 0.1.58 Affected: 0.1.59 Affected: 0.1.60 Affected: 0.1.61 Affected: 0.1.62 Affected: 0.1.63 Affected: 0.1.64 Affected: 0.1.65 Affected: 0.1.66 Affected: 0.1.67 Affected: 0.1.68 Affected: 0.1.69 Affected: 0.1.70 Affected: 0.1.71 Affected: 0.1.72 Affected: 0.1.73 Affected: 0.1.74 Affected: 0.1.75 Affected: 0.1.76 Affected: 0.1.77 Affected: 0.1.78 Affected: 0.1.79 Affected: 0.1.80 Affected: 0.1.81 Affected: 0.1.82 cpe:2.3:a:donetick:donetick:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112045",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:41:03.947391Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:41:32.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:donetick:donetick:*:*:*:*:*:*:*:*"
],
"modules": [
"History Deletion Handler"
],
"product": "donetick",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "0.1.0"
},
{
"status": "affected",
"version": "0.1.1"
},
{
"status": "affected",
"version": "0.1.2"
},
{
"status": "affected",
"version": "0.1.3"
},
{
"status": "affected",
"version": "0.1.4"
},
{
"status": "affected",
"version": "0.1.5"
},
{
"status": "affected",
"version": "0.1.6"
},
{
"status": "affected",
"version": "0.1.7"
},
{
"status": "affected",
"version": "0.1.8"
},
{
"status": "affected",
"version": "0.1.9"
},
{
"status": "affected",
"version": "0.1.10"
},
{
"status": "affected",
"version": "0.1.11"
},
{
"status": "affected",
"version": "0.1.12"
},
{
"status": "affected",
"version": "0.1.13"
},
{
"status": "affected",
"version": "0.1.14"
},
{
"status": "affected",
"version": "0.1.15"
},
{
"status": "affected",
"version": "0.1.16"
},
{
"status": "affected",
"version": "0.1.17"
},
{
"status": "affected",
"version": "0.1.18"
},
{
"status": "affected",
"version": "0.1.19"
},
{
"status": "affected",
"version": "0.1.20"
},
{
"status": "affected",
"version": "0.1.21"
},
{
"status": "affected",
"version": "0.1.22"
},
{
"status": "affected",
"version": "0.1.23"
},
{
"status": "affected",
"version": "0.1.24"
},
{
"status": "affected",
"version": "0.1.25"
},
{
"status": "affected",
"version": "0.1.26"
},
{
"status": "affected",
"version": "0.1.27"
},
{
"status": "affected",
"version": "0.1.28"
},
{
"status": "affected",
"version": "0.1.29"
},
{
"status": "affected",
"version": "0.1.30"
},
{
"status": "affected",
"version": "0.1.31"
},
{
"status": "affected",
"version": "0.1.32"
},
{
"status": "affected",
"version": "0.1.33"
},
{
"status": "affected",
"version": "0.1.34"
},
{
"status": "affected",
"version": "0.1.35"
},
{
"status": "affected",
"version": "0.1.36"
},
{
"status": "affected",
"version": "0.1.37"
},
{
"status": "affected",
"version": "0.1.38"
},
{
"status": "affected",
"version": "0.1.39"
},
{
"status": "affected",
"version": "0.1.40"
},
{
"status": "affected",
"version": "0.1.41"
},
{
"status": "affected",
"version": "0.1.42"
},
{
"status": "affected",
"version": "0.1.43"
},
{
"status": "affected",
"version": "0.1.44"
},
{
"status": "affected",
"version": "0.1.45"
},
{
"status": "affected",
"version": "0.1.46"
},
{
"status": "affected",
"version": "0.1.47"
},
{
"status": "affected",
"version": "0.1.48"
},
{
"status": "affected",
"version": "0.1.49"
},
{
"status": "affected",
"version": "0.1.50"
},
{
"status": "affected",
"version": "0.1.51"
},
{
"status": "affected",
"version": "0.1.52"
},
{
"status": "affected",
"version": "0.1.53"
},
{
"status": "affected",
"version": "0.1.54"
},
{
"status": "affected",
"version": "0.1.55"
},
{
"status": "affected",
"version": "0.1.56"
},
{
"status": "affected",
"version": "0.1.57"
},
{
"status": "affected",
"version": "0.1.58"
},
{
"status": "affected",
"version": "0.1.59"
},
{
"status": "affected",
"version": "0.1.60"
},
{
"status": "affected",
"version": "0.1.61"
},
{
"status": "affected",
"version": "0.1.62"
},
{
"status": "affected",
"version": "0.1.63"
},
{
"status": "affected",
"version": "0.1.64"
},
{
"status": "affected",
"version": "0.1.65"
},
{
"status": "affected",
"version": "0.1.66"
},
{
"status": "affected",
"version": "0.1.67"
},
{
"status": "affected",
"version": "0.1.68"
},
{
"status": "affected",
"version": "0.1.69"
},
{
"status": "affected",
"version": "0.1.70"
},
{
"status": "affected",
"version": "0.1.71"
},
{
"status": "affected",
"version": "0.1.72"
},
{
"status": "affected",
"version": "0.1.73"
},
{
"status": "affected",
"version": "0.1.74"
},
{
"status": "affected",
"version": "0.1.75"
},
{
"status": "affected",
"version": "0.1.76"
},
{
"status": "affected",
"version": "0.1.77"
},
{
"status": "affected",
"version": "0.1.78"
},
{
"status": "affected",
"version": "0.1.79"
},
{
"status": "affected",
"version": "0.1.80"
},
{
"status": "affected",
"version": "0.1.81"
},
{
"status": "affected",
"version": "0.1.82"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "geochen (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: \"The concerns about \"IDOR\" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T03:00:17.338Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421693 | donetick History Deletion model.go CanDeleteHistory improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421693"
},
{
"name": "VDB-421693 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421693/cti"
},
{
"name": "CVE-2026-112045 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112045"
},
{
"name": "Submit #1009027 | https://github.com/donetick/ donetick commit 0ca432c1f7731ef9c4c2f00aad7f2f845ef9c2b3 Improper Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009027"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/donetick/donetick/issues/711"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/donetick/donetick/security/advisories/GHSA-c545-2whr-g2v6"
},
{
"tags": [
"product"
],
"url": "https://github.com/donetick/donetick/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T13:01:04.000Z",
"value": "VulDB entry last update"
}
],
"title": "donetick History Deletion model.go CanDeleteHistory improper authorization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112045",
"datePublished": "2026-10-19T03:00:17.338Z",
"dateReserved": "2026-10-18T10:55:59.567Z",
"dateUpdated": "2026-10-19T17:41:32.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112025 (GCVE-0-2026-112025)
Vulnerability from cvelistv5 – Published: 2026-10-18 22:00 – Updated: 2026-10-19 17:54
VLAI
EPSS
VEX
Title
light0011 cms Captcha Validation UserController.class.php access control
Summary
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:54 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421673 | vdb-entry |
| https://vuldb.com/vuln/421673/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112025 | third-party-advisory |
| https://vuldb.com/submit/1008050 | third-party-advisory |
| https://github.com/light0011/cms/issues/13 | exploitissue-tracking |
| https://github.com/light0011/cms/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112025",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:54:11.204124Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:54:19.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:light0011:cms:*:*:*:*:*:*:*:*"
],
"modules": [
"Captcha Validation"
],
"product": "cms",
"vendor": "light0011",
"versions": [
{
"status": "affected",
"version": "c774dce31c6df0055568a8d5c53d964d99be199d"
},
{
"status": "affected",
"version": "f72cf46f601efb2a0618c3814cc2f61380b38930"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gscsd (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T22:00:14.621Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421673 | light0011 cms Captcha Validation UserController.class.php access control",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/421673"
},
{
"name": "VDB-421673 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421673/cti"
},
{
"name": "CVE-2026-112025 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112025"
},
{
"name": "Submit #1008050 | light0011 cms f72cf46f601efb2a0618c3814cc2f61380b38930 Client-Side Enforcement of Server-Side Security",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1008050"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/light0011/cms/issues/13"
},
{
"tags": [
"product"
],
"url": "https://github.com/light0011/cms/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T09:42:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "light0011 cms Captcha Validation UserController.class.php access control",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112025",
"datePublished": "2026-10-18T22:00:14.621Z",
"dateReserved": "2026-10-18T07:37:27.371Z",
"dateUpdated": "2026-10-19T17:54:19.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110898 (GCVE-0-2026-110898)
Vulnerability from cvelistv5 – Published: 2026-10-19 09:09 – Updated: 2026-10-19 16:50 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability
Summary
Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:50 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WPDeveloper | Essential Addons for Elementor |
Affected:
0 , ≤ 6.8.5
(custom)
|
Date Public
2026-10-17 08:22
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110898",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:50:25.958773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:50:35.254Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "essential-addons-for-elementor-lite",
"product": "Essential Addons for Elementor",
"vendor": "WPDeveloper",
"versions": [
{
"changes": [
{
"at": "6.8.6",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.8.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Kahlon (Adkali) | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-17T08:22:57.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.\u003cp\u003eThis issue affects Essential Addons for Elementor: from n/a through 6.8.5.\u003c/p\u003e"
}
],
"value": "Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:09:19.416Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-8-5-privilege-escalation-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Essential Addons for Elementor plugin to the latest available version (at least 6.8.6)."
}
],
"value": "Update the WordPress Essential Addons for Elementor plugin to the latest available version (at least 6.8.6)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Essential Addons for Elementor plugin \u003c= 6.8.5 - Privilege Escalation vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-110898",
"datePublished": "2026-10-19T09:09:19.416Z",
"dateReserved": "2026-10-15T00:19:27.828Z",
"dateUpdated": "2026-10-19T16:50:35.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110373 (GCVE-0-2026-110373)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:00 – Updated: 2026-10-19 18:56 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability
Summary
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 18:56 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hamid Alinia | Login with phone number |
Affected:
0 , ≤ 1.8.77
(custom)
|
Date Public
2026-10-16 10:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110373",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T18:56:17.642158Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:56:33.875Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "login-with-phone-number",
"product": "Login with phone number",
"vendor": "Hamid Alinia",
"versions": [
{
"changes": [
{
"at": "1.8.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.8.77",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Tang | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-16T10:41:41.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.\u003cp\u003eThis issue affects Login with phone number: from n/a through 1.8.77.\u003c/p\u003e"
}
],
"value": "Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:00:30.495Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/login-with-phone-number/vulnerability/wordpress-login-with-phone-number-plugin-1-8-77-privilege-escalation-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Login with phone number plugin to the latest available version (at least 1.8.78)."
}
],
"value": "Update the WordPress Login with phone number plugin to the latest available version (at least 1.8.78)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Login with phone number plugin \u003c= 1.8.77 - Privilege Escalation vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-110373",
"datePublished": "2026-10-18T11:00:30.495Z",
"dateReserved": "2026-10-14T00:22:17.449Z",
"dateUpdated": "2026-10-19T18:56:33.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110372 (GCVE-0-2026-110372)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:00 – Updated: 2026-10-19 19:01 X_Known Exploited Vulnerability X_Open Source
VLAI
EPSS
VEX
Title
WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability
Summary
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 19:00 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Brainstorm Force | OttoKit |
Affected:
0 , ≤ 1.1.40
(custom)
|
Date Public
2026-10-16 10:36
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T19:00:58.973119Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:01:11.342Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "suretriggers",
"product": "OttoKit",
"vendor": "Brainstorm Force",
"versions": [
{
"changes": [
{
"at": "1.1.41",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.1.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Tang | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-16T10:36:59.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.\u003cp\u003eThis issue affects OttoKit: from n/a through 1.1.40.\u003c/p\u003e"
}
],
"value": "Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T06:38:35.899Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-40-privilege-escalation-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress OttoKit plugin to the latest available version (at least 1.1.41)."
}
],
"value": "Update the WordPress OttoKit plugin to the latest available version (at least 1.1.41)."
}
],
"tags": [
"x_known-exploited-vulnerability",
"x_open-source"
],
"title": "WordPress OttoKit plugin \u003c= 1.1.40 - Privilege Escalation vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-110372",
"datePublished": "2026-10-18T11:00:28.694Z",
"dateReserved": "2026-10-14T00:22:17.449Z",
"dateUpdated": "2026-10-19T19:01:11.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-1
Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-17
Architecture and Design
Operation
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
No CAPEC attack patterns related to this CWE.