SUSE CVE-2025-6226

Mattermost versions 10.5.x = 10.5.6, 10.8.x = 10.8.1, 10.7.x = 10.7.3, 9.11.x = 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of...

CVE-2025-34147

creationtimestamp| type| source ---|---|--- 2025-08-04 20:24:13+00:00| seen| https://bsky.app/profile/undercode.bsky.social/post/3lvlzm2lq2c2c 2025-08-04 21:43:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lvm5ztoqt72s 2025-08-05 00:01:31+00:00| seen|...

CVE-2025-54387

creationtimestamp| type| source ---|---|--- 2025-08-04 07:39:33+00:00| seen| https://bsky.app/profile/pi0.io/post/3lvkouos7n22t 2025-08-04 07:39:34+00:00| seen| https://bsky.app/profile/pi0.io/post/3lvkouosigc2t 2025-08-04 07:46:22+00:00| seen| https://bsky.app/profile/pi0.io/post/3lvkpauh5ik2t...

Cross-site Scripting (XSS)

Mezzanine CMS is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization due to failure to filter user-supplied input in the /blog/blogpost/add component, allowing injection of malicious scripts into blog posts...

CVE-2025-6228: Improper Neutralization of Input During Web Page Generation

The Sina Extension for Elementor Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Sina Posts, Sina Blog Post and Sina Table widgets in all...

CVE-2025-8401

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.1 via the 'getpostdata' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive...

CVE-2025-4425

creationtimestamp| type| source ---|---|--- 2025-07-30 03:01:15+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lv5myi7qbb2d 2025-07-30 03:02:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lv5n23uovd2s...

WordPress hiWeb Export Posts Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress hiWeb Export Posts, which stems from missing or incorrect random number validation, and can be exploited by a...

Mars: SQLi at █████ parameter

A SQL injection vulnerability was discovered in an items endpoint that accepted unauthenticated POST requests without CSRF validation. The vulnerability allowed execution of arbitrary SQL commands and extraction of database metadata. Additional security issues included stored XSS through the...

CVE-2025-54768

creationtimestamp| type| source ---|---|--- 2025-07-29 00:16:07+00:00| seen| https://bsky.app/profile/nimblenerd.social/post/3lv2tcazdnq26 2025-07-29 01:10:34+00:00| seen| https://bsky.app/profile/jimbecher.bsky.social/post/3lv2wdmsm4s2k 2025-07-29 02:49:14+00:00| seen|...

WordPress plugin Kallyas has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2025-8169

creationtimestamp| type| source ---|---|--- 2025-07-25 20:45:07+00:00| seen| https://bsky.app/profile/potato.software/post/3lusw43zpe52c 2025-07-25 20:45:52+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114915826085504624...

Improper Authorization

github.com/mattermost/mattermost-server is vulnerable to Improper Authorization. The vulnerability is due to a failure to verify authorization when retrieving cached posts by PendingPostID, which allows an attacker to read posts from private channels they do not have access to by guessing the...

CVE-2025-45893: Improper Neutralization of Input During Web Page Generation

OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting XSS attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded...

CVE-2025-45893

OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting XSS attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded...

CVE-2025-7640 hiWeb Export Posts <= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletion

The hiWeb Export Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.0.0. This is due to missing or incorrect nonce validation on the tool-dashboard-history.php file. This makes it possible for unauthenticated attackers to delete...

CVE-2025-7640: Improper Limitation of a Pathname to a Restricted Directory

The hiWeb Export Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.0.0. This is due to missing or incorrect nonce validation on the tool-dashboard-history.php file. This makes it possible for unauthenticated attackers to delete...

PT-2025-30653 · WordPress · Hiweb Export Posts

Name of the Vulnerable Software and Affected Versions: hiWeb Export Posts plugin for WordPress versions up to and including 0.9.0.0 Description: The hiWeb Export Posts plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...

WordPress plugin hiWeb Export: Path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress hiWeb Export Posts, which stems from missing or incorrect random number validation, and can be exploited by a...

RHSA-2023:7077

creationtimestamp| type| source ---|---|--- 2025-07-23 19:38:05+00:00| seen| Telegram/7dqI0T7UDX-m5iuSwEoYuCcQjqNmKpc0btwU4cyV1G7Uc 2025-07-23 19:38:08+00:00| seen| Telegram/yffDVxtiYaWwp3UyhuKhfb81Vl84aAOxSkdR3j5tCAnhVI 2025-07-23 19:38:10+00:00| seen|...