Visualizer
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:visualizer:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Visualizer (a99970ea-b511-506d-9580-1fc9a1ef817e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14939 |
vulnerable | 2026-09-16 04:33:12.423948 |
Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import
The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.
Published: 2026-08-04T06:00:10.414Z
Updated: 2026-08-04T17:33:45.277Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86782 |
vulnerable | 2026-09-16 04:32:58.954465 |
Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.
Published: 2026-09-11T06:00:09.194Z
Updated: 2026-09-11T10:00:38.078Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86779 |
vulnerable | 2026-09-16 04:32:58.480255 |
Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.
Published: 2026-09-11T06:00:08.664Z
Updated: 2026-09-11T10:08:49.275Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.