CVE-2026-54184

HighCVSS 8.2/10Last modified Oct 26, 2026

Description

Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
Alberto HorneroClean Login<= 1.15

References

Timeline

Published
Jun 17, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-541858.5Subscriber SQL Injection in Cornerstone < 7.8.8 versions.CVE-2026-541869.3Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.CVE-2026-541879.3Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.CVE-2026-541887.1Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.CVE-2026-541897.1Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.CVE-2026-54193.7A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allCVE-2026-541906.5Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.CVE-2026-541917.1Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.CVE-2026-541927.1Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.CVE-2026-541937.7Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.CVE-2026-541949.8Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.CVE-2026-541957.1Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.
CVE-2026-54184: High severity, CVSS 8.2 | Vulnix