CVE-2025-1259

CVE-2025-1259 affects Arista EOS when OpenConfig is configured; a gNOI request can be accepted where it should be rejected, potentially allowing data exposure. The Arista advisory lists affected EOS trains and versions (4.33.x, 4.32.x, 4.31.x, 4.30.x, 4.29.x, 4.28.x and earlier in those trains) a...

CVE-2025-1259: Improper Access Control

On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in users retrieving data that should not have been available...

CVE-2024-13833

The Album Gallery – WordPress Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.3 via deserialization of untrusted input from gallery meta. This makes it possible for authenticated attackers, with Editor-level access and above, to inject ...

Mattermost SQL Injection Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a SQL injection vulnerability that stems from the use of uncompiled statements, which can be exploited by an attacker to retrieve database data via a specially designed sorting...

CVE-2022-49285 iio: accel: mma8452: use the correct logic to get mma8452_data

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: use the correct logic to get mma8452data The original logic to get mma8452data is wrong, the dev point to the device belong to iiodev. we can't use this dev to find the correct i2cclient. The original logic...

CVE-2022-49285

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: use the correct logic to get mma8452data The original logic to get mma8452data is wrong, the dev point to the device belong to iiodev. we can't use this dev to find the correct i2cclient. The original logic...

CVE-2025-24490 SQL Injection in Mattermost Boards via board category ID reordering

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories...

CVE-2025-24490 SQL Injection in Mattermost Boards via board category ID reordering

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories...

CVE-2025-24490

Mattermost contains a SQL injection vulnerability (CVE-2025-24490) caused by not using prepared statements in the SQL query used for boards reordering. Affected versions include 9.11.x <= 9.11.7, 10.2.x <= 10.2.2, 10.3.x <= 10.3.2, and 10.4.x

CVE-2024-13899

The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted input via the $data parameter in the fImportMenu function. This makes it possible for authenticated attackers, with Administrator-level access a...

CVE-2025-24490: Improper Neutralization of Special Elements used in an SQL Command

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories...

PT-2025-7708 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.7 Mattermost versions 10.2.x through 10.2.2 Mattermost versions 10.3.x through 10.3.2 Mattermost versions 10.4.x through 10.4.1 Description: The issue allows an attacker to retrieve data from the databa...

CVE-2025-22633

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in StellarWP Give – Divi Donation Modules give-donation-modules-for-divi allows Retrieve Embedded Sensitive Data.This issue affects Give – Divi Donation Modules: from n/a through = 2.0.0...

CVE-2025-22633

CVE-2025-22633 is a vulnerability in the WordPress plugin Give – Divi Donation Modules (give-donation-modules-for-divi) affecting versions up to and including 2.0.0. The issue is described as an insertion of sensitive information into externally-accessible files or directories, enabling retrieval...

CVE-2025-1132

A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the ENtyid parameter. The parameter is directly inserted into an SQL query without proper sanitization, allowing attackers to inject malicious SQL commands. Please note that the...

CVE-2024-13789 Ravpage <= 2.31 - PHP Object Injection

The ravpage plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.31 via deserialization of untrusted input from the 'paramsv2' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the...

CVE-2024-13636

CVE-2024-13636 is rejected/not used and does not represent an active vulnerability entry.

CVE-2024-13556 Affiliate Links: WordPress Plugin for Link Cloaking and Link Management <= 3.0.1 - Missing Authorization to Unauthenticated Import/Export and PHP Object Injection

The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.1 via deserialization of untrusted input from an file export. This makes it possible for unauthenticated attackers to...

CVE-2025-24567

Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through = 1.8.16.0...

CVE-2025-22961

A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due to Incorrect Access Control CWE-284. Unauthenticated attackers can directly access sensitive database backup files snapshotusers.db via publicly exposed URLs...