Filtered by vendor Cyberlord92 Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-10750 2 Cyberlord92, Wordpress 2 Powerbi Embed Reports, Wordpress 2025-10-21 5.3 Medium
The PowerBI Embed Reports plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.2.0. This is due to missing capability checks and authentication verification on the 'testUser' endpoint accessible via the mo_epbr_admin_observer() function hooked on 'init'. This makes it possible for unauthenticated attackers to access sensitive Azure AD user information including personal identifiable information (PII) such as displayName, mail, phones, department, or detailed OAuth error data including Azure AD Application/Client IDs, error codes, trace IDs, and correlation IDs.
CVE-2025-10648 2 Cyberlord92, Wordpress 2 Yourmembership Single Sign On, Wordpress 2025-10-21 5.3 Medium
The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to read the profile data of the latest SSO login.
CVE-2024-9887 1 Cyberlord92 1 Login Using Wordpress Users 2024-11-19 7.2 High
The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.