CVE-2018-10949

Zimbra Collaboration User Enumeration Script CVE-2018-10949 How to use The argument --host must be the hostname or IP address of Zimbra Collaboration Web Application root page, and --userlist an list of usernames to check against it. root@kali ./cve-2018-10949-user-enum.py --host...

WordPress Tainacan plugin < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure vulnerability

Subscriber+ Repository Staff Email Address Disclosure vulnerability discovered by Artus KG in WordPress Plugin Tainacan versions 1.4.0...

PT-2026-110590

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to...

WordPress User Private Files plugin < 2.1.9 - Subscriber+ User Email Address Disclosure vulnerability

Subscriber+ User Email Address Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin User Private Files versions 2.1.9...

CVE-2026-97331 User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including...

CVE-2026-97331

The User Private Files WordPress plugin, in versions before 2.1.9 , is vulnerable to a subscriber-level user email address disclosure. The flaw exists because the plugin fails to validate that a supplied user actually belongs to the document being operated on before returning that user's email ad...

CVE-2026-97331 User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including...

CVE-2026-89331 FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...

CVE-2026-89331

The FluentBoards WordPress plugin (versions 1.95-2.0.15 ) is vulnerable to an unauthenticated board member email address disclosure vulnerability. The flaw exists because the plugin fails to properly restrict member data returned by its public, token-shared board feature . This allows unauthentic...

WordPress FluentBoards plugin 1.95-2.0.15 - Unauthenticated Board Member Email Address Disclosure vulnerability

Unauthenticated Board Member Email Address Disclosure vulnerability discovered by vuxvinh in WordPress Plugin FluentBoards versions 1.95-2.0.15...

CVE-2026-89030: Missing Authorization

Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2ssearchuser AJAX handler in includes/Ajax/Get.php invokes B2STools::searchUser in includes/Tools.php, which returns the email address of every...

CVE-2026-90934: Incorrect Authorization

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

CVE-2026-10597: Authorization Bypass Through User-Controlled Key

OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to obtain user's email address...

CVE-2025-69284: Improper Access Control

Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https://app.plane.so/:slug/settings. Prior to Plane version 1.2.0, a problem occurs when the /api/workspaces/:slug/members/ is accessible by guest and able to list of users on a...

CVE-2024-50671

Incorrect access control in Adapt Learning Adapt Authoring Tool = 0.11.3 allows attackers with Authenticated User roles to obtain email addresses via the "Get users" feature. The vulnerability occurs due to a flaw in permission verification logic, where the wildcard character in permitted URLs...

CVE-2024-8009 Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure

The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page...

CVE-2024-8009 Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure

The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page...

CVE-2024-50671

Incorrect access control in Adapt Learning Adapt Authoring Tool = 0.11.3 allows attackers with Authenticated User roles to obtain email addresses via the "Get users" feature. The vulnerability occurs due to a flaw in permission verification logic, where the wildcard character in permitted URLs...

CVE-2024-50671: Incorrect Authorization

Incorrect access control in Adapt Learning Adapt Authoring Tool = 0.11.3 allows attackers with Authenticated User roles to obtain email addresses via the "Get users" feature. The vulnerability occurs due to a flaw in permission verification logic, where the wildcard character in permitted URLs...

CVE-2024-27937: Improper Authorization

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13...