CVE-2022-38461

MEDIUM Year: 2022
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-264
View all →

Vulnerability Description

Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content).

Related Vulnerabilities

CVE-2014-6276

MEDIUM
CVSS:4.3(Medium)

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing ...

CWE-2642014

CVE-2015-0861

MEDIUM
CVSS:4.3(Medium)

model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write ...

CWE-2642015

CVE-2015-3273

MEDIUM
CVSS:4.3(Medium)

mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated u...

CWE-2642015

CVE-2015-5020

MEDIUM
CVSS:4.3(Medium)

The Big SQL component in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0 allows remote authenticated users to bypass intended access restrictions and truncate arbitrary tables via unspecifie...

CWE-2642015

CVE-2015-5051

MEDIUM
CVSS:4.3(Medium)

IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud Control Desk allow re...

CWE-2642015

CVE-2015-5265

MEDIUM
CVSS:4.3(Medium)

The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, w...

CWE-2642015