11066 matches found
CVE-2025-41410
Mattermost CVE-2025-41410 affects server versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, and 10.11.x
CVE-2025-41410 Slack import bypasses email verification for team access controls
Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictio...
CVE-2025-41410 Slack import bypasses email verification for team access controls
Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictio...
CVE-2025-10051
The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...
Nextcloud Tables 安全漏洞
Nextcloud Tables is an open source tables application from Nextcloud. A security vulnerability exists in Nextcloud Tables versions prior to 0.7.6, prior to 0.8.8, and prior to 0.9.5, which stems from a server file that can be specified when importing a table, potentially leading to a disclosure o...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability in Mattermost 10.10.2 and prior versions 10.10.x, 10.5.10 and prior versions 10.5.x, and 10.11.2 and prior versions 10.11.x, which stems from the failure to validate email...
CVE-2025-10051
The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...
CVE-2025-10051 Demo Import Kit <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload
The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...
CVE-2025-10051 Demo Import Kit <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload
The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...
CVE-2025-10051
CVE-2025-10051 affects the WordPress plugin “Demo Import Kit” (versions ≤ 1.1.0). The vulnerability is an authenticated arbitrary file upload due to missing file type validation in the import function, enabling an Administrator+ attacker to upload arbitrary files to the server and potentially ach...
EUVD-2025-34560
The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...
WordPress Demo Import Kit plugin <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload vulnerability
Authenticated Admin+ Arbitrary File Upload vulnerability discovered by vodanh in WordPress Plugin Demo Import Kit versions = 1.1.0...
ERPNext import_coa function SQL injection vulnerability
ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a SQL injection vulnerability that stems from the lack of validation of the importcoa function's company parameter against externally entered SQL statements. An attacker can exploit this...
WordPress plugin Demo Import Kit 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. An arbitrary file upload vulnerability exists in the WordPress Demo Import Kit plugin, which stems from a lack of file type validation in the import function and can be exploite...
WordPress TheGem Demo Import (for WPBakery) plugin <= 5.10.5 - Arbitrary Content Deletion vulnerability
Arbitrary Content Deletion vulnerability discovered by ? in WordPress Plugin TheGem Demo Import for WPBakery versions = 5.10.5...
CVE-2025-8682
The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsupadmininfoinstallplugin function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin...
CVE-2025-8682
Newsup theme for WordPress (up to version 5.0.10) is vulnerable to unauthorized plugin installation due to a missing capability check in newsup_admin_info_install_plugin(). Unauthenticated attackers could install the ansar-import plugin. Patch 5.0.11 fixes the issue; update to 5.0.11 or later. CV...
PT-2025-41679
Name of the Vulnerable Software and Affected Versions Newsup theme for WordPress versions prior to 5.0.11 Description The Newsup theme for WordPress is susceptible to unauthorized plugin installation. This is due to a missing capability check within the newsup admin info install plugin function...
OSV-2025-825 UNKNOWN WRITE in RescalerImportRowExpand_SSE2
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=449781448 Crash type: UNKNOWN WRITE Crash state: RescalerImportRowExpandSSE2 WebPRescalerImport ProcessRows...