CVE-2025-55073

Mattermost Server contains CVE-2025-55073: versions 10.11.x (<=10.11.3), 10.5.x (<=10.5.11), and 10.12.x (

CVE-2025-55073 MS Teams plugin OAuth allows editing arbitrary posts

Mattermost versions 10.11.x = 10.11.3, 10.5.x = 10.5.11, 10.12.x = 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost versions 10.11.3 and prior to 10.11.x, 10.5.11 and prior to 10.5.x, and 10.12.0 and prior to 10.12.x. The vulnerability stems from an unvalidated post upda...

CVE-2025-5071

The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'MeowMWAILabsMCP::canaccessmcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and...

WordPress custom-post-edit plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin custom-post-edit versions = 1.0.4...

Online News site 安全漏洞

Online News site is an online news site by the individual developer Mobina Jafarian. A security vulnerability exists in Online News site version v1.0, which stems from vulnerability to cross-site scripting XSS attacks and allows an attacker to execute arbitrary code via the title and summary fiel...

PT-2024-39539 · Unknown · Bg5Sbk Minicms

Name of the Vulnerable Software and Affected Versions: bg5sbk MiniCMS versions up to 1.11 Description: A vulnerability was found in bg5sbk MiniCMS, affecting some unknown processing of the file post-edit.php, leading to cross-site request forgery. The attack may be initiated remotely. The exploit...

CVE-2023-5352

The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpaseditreply function, allowing users to edit posts for which they do not have permission...

CVE-2023-37906 Discourse vulnerable to DoS via post edit reason

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of th...

Design/Logic Flaw

Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum this is caused by a lack of checks performed by the /forums.php?action=post page...

CVE-2022-46890

Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum this is caused by a lack of checks performed by the /forums.php?action=post page...

CVE-2022-36573

A cross-site scripting XSS vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit...

CVE-2021-41663

A cross-site scripting XSS vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: post-edit.php page...

MiniCMS 跨站脚本漏洞

MiniCMS is content management system. A cross-site scripting vulnerability exists in MiniCMS version V1.11, which stems from a lack of checksum filtering of user-supplied and output data on the post-edit.php page. An attacker can exploit this vulnerability to execute JavaScript code on the client...

CVE-2020-36052

Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter...

Cross site scripting

po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post1content= stored XSS...

MiniCMS Cross-Site Scripting Vulnerability (CNVD-2019-23979)

MiniCMS is a content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in the mc-admin/post-edit.php file in MiniCMS version 1.10. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can...

MiniCMS Cross-Site Scripting Vulnerability (CNVD-2019-21430)

MiniCMS is a content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in the mc-admin/post-edit.php file in MiniCMS version 1.10, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this...

CVE-2019-13186

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, and CVE-2018-20520...

mybb -- vulnerabilities

mybb Team reports: High risk: Theme import stylesheet name RCE High risk: Nested video MyCode persistent XSS Medium risk: Find Orphaned Attachments reflected XSS Medium risk: Post edit reflected XSS Medium risk: Private Messaging folders SQL injection Low risk: Potential phar deserialization...