CVE-2025-0679

CVE-2025-0679 affects GitLab CE/EE (versions 17.1–before 17.10.7, 17.11–before 17.11.3, and 18.0–before 18.0.1). The issue permits unauthorised users to view full email addresses that should be partially obscured under specific conditions. Root cause described as disclosure of private PII via UI/...

CVE-2024-8009

The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page...

PT-2025-21506 · WordPress · Sensei Lms

Name of the Vulnerable Software and Affected Versions: The Sensei LMS WordPress plugin versions prior to 4.20.0 Description: The issue allows disclosure of all users of the blog, including their email addresses, to teachers on the students page. Recommendations: For versions prior to 4.20.0, upda...

CVE-2025-27568

An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request...

CVE-2025-30150 Shopware 6 allows attackers to check for registered accounts through the store-api

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates...

HackerOne: The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present

The /reports/:id.json endpoint disclosed potentially sensitive user attributes, including the reporter's email, OTP backup codes, phone number, graphqlsecrettoken, and t-shirt size when a reporter summary was present...

Exploit for Missing Authorization in Myeventon Eventon

CVE-2024-0235-PoC The EventON WordPress plugin before 4.5.5, E...

CVE-2024-50671

Incorrect access control in Adapt Learning Adapt Authoring Tool = 0.11.3 allows attackers with Authenticated User roles to obtain email addresses via the "Get users" feature. The vulnerability occurs due to a flaw in permission verification logic, where the wildcard character in permitted URLs...

Apache Answer 安全漏洞

Apache Answer is a community platform of the Apache USA Foundation. A security vulnerability exists in Apache Answer version 1.3.5 and prior versions, which stems from the fact that accessing Gravatar using the MD5 value of a user's email is insecure and could lead to the disclosure of the user's...

GitLab Tags RSS Feed Email Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GitLab Tags RSS feed email disclosure', 'Description' = %q An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prio...

Exploit for CVE-2023-6444

CVE-202306444-POC Proof of concept...

GitLab 13.4 < 13.4.7 / 13.5 < 13.5.5 / 13.6 < 13.6.2 (CVE-2020-26413)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible. CVE-2020-2641...

WordPress WooCommerce Customers Manager plugin < 29.8 - Subscriber+ Email Disclosure vulnerability

Subscriber+ Email Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin WooCommerce Customers Manager versions 29.8...

CVE-2024-1756 WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name...

CVE-2024-1756 WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name...

CVE-2024-31245 WordPress ConvertKit plugin <= 2.4.5 - Email Disclosure in Log File vulnerability

Insertion of Sensitive Information into Log File vulnerability in ConvertKit.This issue affects ConvertKit: from n/a through 2.4.5...

WordPress ConvertKit plugin <= 2.4.5 - Email Disclosure in Log File vulnerability

Email Disclosure in Log File vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin ConvertKit versions = 2.4.5...

CVE-2023-6444

The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address which by default is the admin email address via an unauthenticated crafted request...

Cross site request forgery (csrf)

The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address which by default is the admin email address via an unauthenticated crafted request...

CVE-2023-6444

Seriously Simple Podcasting WordPress plugin versions prior to 3.0.0 disclose the Podcast owner's email via an unauthenticated crafted request. Impact: unauthorized disclosure of administrator email addresses; remediation: upgrade to version 3.0.0 or later.