PT-2025-7820 · WordPress · Enfold

Name of the Vulnerable Software and Affected Versions: Enfold theme for WordPress versions up to, and including, 6.0.9 Description: The issue allows unauthorized access to data due to a missing capability check in the avia-export-class.php file. This enables unauthenticated attackers to export al...

PT-2025-7903

Name of the Vulnerable Software and Affected Versions Odoo Community version 15.0 Odoo Enterprise version 15.0 Description The issue is related to improper access control in the auth oauth module, allowing an internal user to export the OAuth tokens of other users. Recommendations For Odoo...

CVE-2024-12368: Improper Access Control

Improper access control in the authoauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users...

WordPress Enfold theme <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php vulnerability

Missing Authorization to Sensitive Information Disclosure in avia-export-class.php vulnerability discovered by mikemyers in WordPress Theme Enfold versions = 6.0.9...

GHSA-Q8P2-2HWC-JW64 Mattermost fails to restrict channel export of archived channels

Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...

Mattermost fails to restrict channel export of archived channels

Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...

CVE-2025-24526

Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...

CVE-2025-25279 Arbitrary file read in Mattermost Boards via import & export board archive

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards...

CVE-2025-25279 Arbitrary file read in Mattermost Boards via import & export board archive

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards...

CVE-2025-24526 Channel export permitted on archived channel when viewing archived channels is disabled

Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...

CVE-2025-24526

Mattermost CVE-2025-24526 affects multiple 9.x/10.x release branches where exporting archived channel content is not properly restricted when the 'Allow users to view archived channels' setting is disabled. The root cause is insufficient access control for archived-channel exports, enabling an au...

CVE-2025-24526 Channel export permitted on archived channel when viewing archived channels is disabled

Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...

CVE-2025-24526

Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...

CVE-2025-24526 Channel export permitted on archived channel when viewing archived channels is disabled

Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...

Mattermost security vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that stems from a failure to properly restrict the export of archived channels, resulting in users being able to export content...

PT-2025-7706

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.7 Mattermost versions 10.1.x through 10.1.3 Mattermost versions 10.2.x through 10.2.2 Mattermost versions 10.3.x through 10.3.2 Mattermost versions 10.4.x through 10.4.1 Description The issue allows a us...

CVE-2025-24526: Incorrect Authorization

Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...

Linux kernel device driver DoS

The vulnerability of the devres component of the Linux operating system’s kernel is related to the lack of memory release after the effective lifespan of the EXPORTSYMBOLGPL function. Exploiting this vulnerability can allow an attacker to cause a service failure...

WordPress DB Tables Import/Export Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin DB Tables Import/Export versions = 1.0.1...

CVE-2024-13783

The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to, and including, 3.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all plugin da...