CVE-2025-13821 User profile update exposes password hash and MFA secrets

Mattermost versions 11.1.x = 11.1.2, 10.11.x = 10.11.9, 11.2.x = 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID:...

CVE-2025-13821 User profile update exposes password hash and MFA secrets

Mattermost versions 11.1.x = 11.1.2, 10.11.x = 10.11.9, 11.2.x = 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID:...

EUVD-2026-6117

A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketSearch. This manipulation of the argument Profile causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the...

CVE-2026-2545 LigeroSmart index.pl cross site scripting

A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketSearch. This manipulation of the argument Profile causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the...

CVE-2026-2545 LigeroSmart index.pl cross site scripting

A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketSearch. This manipulation of the argument Profile causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the...

CVE-2026-1750

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'savecustomuserprofilefields' function. This makes it possible for authenticated attackers, with...

CVE-2026-23187

creationtimestamp| type| source ---|---|--- 2026-02-16 01:41:30+00:00| seen| https://bsky.app/profile/undercode.bsky.social/post/3mewwaw2kg72p 2026-03-13 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0291/ 2026-03-16 03:00:00+00:00| seen|...

LigeroSmart 代码注入漏洞

LigeroSmart is an open-source management platform developed by LigeroSmart. Versions of LigeroSmart 6.1.26 and earlier contained a code injection vulnerability. This vulnerability stemmed from improper handling of the Profile parameter in the file/otrs/index.pl?Action=AgentTicketSearch, which cou...

CVE-2026-24458

creationtimestamp| type| source ---|---|--- 2026-02-16 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0173/ 2026-03-18 19:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mheajdlwww2m...

PT-2026-8319

A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketSearch. This manipulation of the argument Profile causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the...

CVE-2026-25753

creationtimestamp| type| source ---|---|--- 2026-02-15 11:23:47+00:00| seen| https://bsky.app/profile/undercode.bsky.social/post/3mevgd7g2uc27...

CVE-2026-1750

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'savecustomuserprofilefields' function. This makes it possible for authenticated attackers, with...

EUVD-2026-5834

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'savecustomuserprofilefields' function. This makes it possible for authenticated attackers, with...

CVE-2026-1750 Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'savecustomuserprofilefields' function. This makes it possible for authenticated attackers, with...

CVE-2026-1750 Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'savecustomuserprofilefields' function. This makes it possible for authenticated attackers, with...

CVE-2025-69633

creationtimestamp| type| source ---|---|--- 2026-02-15 02:27:57+00:00| published-proof-of-concept| https://t.me/realcodeb0ss/321 2026-02-17 16:20:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf2xtwdib52c...

PT-2026-8223

Name of the Vulnerable Software and Affected Versions Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress versions through 7.0.7 Description The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is susceptible to a privilege escalation issue. An authenticated attacker...

CVE-2026-25232

creationtimestamp| type| source ---|---|--- 2026-02-14 20:49:02+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-2c6v-8r3v-gh6p 2026-02-19 20:21:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfag7odeeq2h 2026-04-18 21:00:04+00:00|...

CVE-2026-20620

creationtimestamp| type| source ---|---|--- 2026-02-14 08:13:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mesl7kpiow2a...

CVE-2026-1988

creationtimestamp| type| source ---|---|--- 2026-02-14 07:18:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mesi63vgu72g 2026-02-14 10:30:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/116068517992447814 2026-02-14 10:30:35+00:00| seen|...