Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2025-59133

WordPress Projectopia plugin <= 5.1.25.2 - Insecure Direct Object References (IDOR) vulnerability

Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Projectopia Wordpress
Products
Projectopia Wordpress
CVE-2025-48257

WordPress Projectopia plugin <= 5.1.17 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Projectopia Projectopia projectopia-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Projectopia: from n/a through <= 5.1.17.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Projectopia Wordpress
Products
Projectopia Wordpress
CVE-2025-32648

WordPress Projectopia plugin <= 5.1.24 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Projectopia Projectopia projectopia-core allows Privilege Escalation.This issue affects Projectopia: from n/a through <= 5.1.24.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Projectopia Wordpress
Products
Projectopia Wordpress
CVE-2024-54336

WordPress Projectopia plugin <= 5.1.7 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Projectopia Projectopia projectopia-core allows Authentication Bypass.This issue affects Projectopia: from n/a through <= 5.1.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Projectopia Wordpress
Products
Projectopia Wordpress
CVE-2025-3952

Projectopia &#8211; WordPress Project Management <= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion

The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'pto_remove_logo' function in all versions up to, and including, 5.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Projectopia
Products
Projectopia
CVE-2025-12876

Projectopia – WordPress Project Management <= 5.1.19 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pto_delete_file AJAX action in all versions up to, and including, 5.1.19. This makes it possible for unauthenticated attackers to delete arbitrary attachments.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Projectopia Wordpress
Products
Projectopia Wordpress