CVE-2026-111914
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authent
CVSS
6.5
Média
EPSS
0.3%
p24
KEV
—
Exploit Today
7
0-100
Publicado: 17 de out. de 2026 · Última mod.: 19 de out. de 2026 · CWE-862
0.2%EPSS · 30 dias0.3%
2026-10-182026-11-06
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.
- github.comhttps://github.com/Admidio/admidio/security/advisories/GHSA-5f29-r7rj-43mf
- github.comhttps://github.com/Admidio/admidio/security/advisories/GHSA-qfjf-c48f-x87g
- www.vulncheck.comhttps://www.vulncheck.com/advisories/admidio-5.0.11-before-5.0.16-broken-access-control-via-inventory-data-php
- github.comhttps://github.com/Admidio/admidio/security/advisories/GHSA-5f29-r7rj-43mf
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1234745.3 MÉD—
———Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18.5hCVE-2026-1234674.3 MÉD—
———Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.5hCVE-2026-1234625.3 MÉD—
———Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.5hCVE-2026-1226635.3 MÉD—
———Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.5hCVE-2026-1226604.3 MÉD—
———Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.5hCVE-2026-1226595.4 MÉD—
———Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0.5h