CVE-2024-25619 Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon

Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue...

Mastodon Vulnerability Allows Hackers to Hijack Any Decentralized Account

The decentralized social network Mastodon has disclosed a critical security flaw that enables malicious actors to impersonate and take over any account. "Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account," the maintainers said in a...

mooSocial 3.1.8 - Cross-Site Scripting (XSS) on User Login Page

Exploit Title: mooSocial 3.1.8 - Cross-Site Scripting XSS on User Login Page Date: 26 September 2023 Exploit Author: Astik Rawat ahrixia Vendor Homepage: https://moosocial.com Software Link: https://travel.moosocial.com/ Version: 3.1.8 Tested on: Windows 11 CVE : CVE-2023-43325 Description: A Cro...

Design/Logic Flaw

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is...

CVE-2024-23832 Mastodon Remote user impersonation and takeover

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is...

CVE-2024-22158

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User...

CVE-2024-22158

CVE-2024-22158 affects PeepSo Community: Photos plugin (

FlyCms Security Vulnerability

sunkaifei FlyCms is sunkaifei open source application . A similar to Zhihu to Q&A based on the fully open source JAVA language development of social networking site builder . FlyCms security vulnerabilities , the vulnerability stems from the existence of cross-site scripting vulnerabilities...

CVE-2023-47191 WordPress Youzify Plugin <= 1.2.2 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress.This issue affects Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress: from n/a...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Reflected XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User...

CVE-2023-47850

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User...

CVE-2023-47850

CVE-2023-47850 affects the WordPress plugin Community by PeepSo – PeepSo Core up to version 6.2.2.0, with stored stored Cross-Site Scripting (XSS) arising from improper input neutralization during web page generation. Public details confirm the vulnerability and affected versions; PatchStack note...

WordPress Plugin Community by PeepSo - Social Network, Membership, Registration, User Profiles Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin = 6.0.9.0 versions...

CVE-2023-32092

CVE-2023-32092 is a CSRF vulnerability in the WordPress plugin “Community by PeepSo – Social Network, Membership, Registration, User Profiles” (PeepSo Core) reported for versions

lte-pic32-writer security vulnerability

lte-pic32-writer is a writing program for pic32 devices by paijp personal developer. A security vulnerability exists in lte-pic32-writer v0.0.1 and earlier versions, which originates from the fact that users with an IMEI can read sendto.txt, and the sendto.txt file can contain SNS e.g. slack, zul...

CVE-2023-42452 Mastodon vulnerable to Stored XSS through the translation feature

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to...

CVE-2023-42452

Mastodon CVE-2023-42452 affects 4.x branches prior to 4.0.10, 4.2.8, and 4.2.0-rc2. The issue allows Stored XSS via the translation feature by bypassing server-side HTML sanitization and executing unescaped HTML in the browser. Exploitation requires user interaction (clicking the Translate button...

CVE-2023-42451

CVE-2023-42451 affects Mastodon: prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, there is a flaw in domain name normalization that can allow attackers to spoof domains they do not own under certain circumstances. A patch exists in versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2. The root ca...

CVE-2023-42451 Mastodon Invalid Domain Name Normalization vulnerability

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc...