https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 08:02:58 +0000 https://cve.radiocsirt.org/vuln/cve-2025-11877 <p><strong>Affected:</strong> solwininfotech User Activity Log</p> <p>The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler &#39;ual_shook_wp_login_failed&#39; lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like &#39;wp_user_roles&#39;, breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.</p> <p><strong>Affected:</strong> solwininfotech User Activity Log</p> <p>The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler &#39;ual_shook_wp_login_failed&#39; lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like &#39;wp_user_roles&#39;, breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.</p> https://cve.radiocsirt.org/vuln/cve-2025-11877