CVE-2026-16047: Missing Authorization

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing...

CVE-2026-9859: Incorrect Authorization

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...

CVE-2026-19828 648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The explo...

CVE-2026-19828: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The explo...

CVE-2023-6459: Exposure of Sensitive Information to an Unauthorized Actor

Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs...

Sql injection

An issue was discovered in ClipBucket before 4.0.0 Release 4902. SQL injection vulnerabilities exist in the actions/votechannel.php channelId parameter, the ajax/commonAjax.php email parameter, and the ajax/commonAjax.php username parameter...

CVE-2018-7666

An issue was discovered in ClipBucket before 4.0.0 Release 4902. SQL injection vulnerabilities exist in the actions/votechannel.php channelId parameter, the ajax/commonAjax.php email parameter, and the ajax/commonAjax.php username parameter...

CVE-2018-7666: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in ClipBucket before 4.0.0 Release 4902. SQL injection vulnerabilities exist in the actions/votechannel.php channelId parameter, the ajax/commonAjax.php email parameter, and the ajax/commonAjax.php username parameter...

JINGLUN OA system /Systems/menu/func_edit. aspx file ChannelId parameter SQL injection vulnerability

No description provided by source...

Google Strong Authentication Strategy Eliminates Passwords

Gmail and Google Apps account hijacking has been the linchpin of a number of high-profile targeted attacks, starting with the Aurora attacks of 2009, right up until last week’s attack against the Twitter account belonging to the satirical Onion news site. Granted we’re talking about two very...

动易NewComment.asp注入漏洞

在NewComment.asp文件中 ModuleName = Trimrequest"ModuleName" 这个ModuleName变量没过滤好，从而导致，我们可以在下面的SQL语句中构造我们的 SQL语句 If ModuleName "" Then If ChannelID 0 Then If ClassID 0 Then sqlComment = "Select top " & Num & " C. from PEComment C left join PE" & ModuleName & " A on C.InfoID=A." & ModuleName &...