Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the Slack import functionality. An attacker can create verified user accounts with arbitrary email domains by submitting malicious import data to bypass email-based team access restrictions. Remediation Upgrade...

GHSA-3Q4Q-WQM6-HVF3 Mattermost has a Missing Authorization vulnerability

Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictio...

CVE-2025-41410

Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictio...

CVE-2025-41410

Mattermost CVE-2025-41410 affects server versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, and 10.11.x

CVE-2025-41410 Slack import bypasses email verification for team access controls

Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictio...

CVE-2025-41410 Slack import bypasses email verification for team access controls

Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictio...

CVE-2025-41410 Slack import bypasses email verification for team access controls

Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictio...

CVE-2025-10051

The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...

Nextcloud Tables 安全漏洞

Nextcloud Tables is an open source tables application from Nextcloud. A security vulnerability exists in Nextcloud Tables versions prior to 0.7.6, prior to 0.8.8, and prior to 0.9.5, which stems from a server file that can be specified when importing a table, potentially leading to a disclosure o...

CVE-2025-58051: Improper Enforcement of Behavioral Workflow

Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leake...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability in Mattermost 10.10.2 and prior versions 10.10.x, 10.5.10 and prior versions 10.5.x, and 10.11.2 and prior versions 10.11.x, which stems from the failure to validate email...

PT-2025-42443

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.10.x through 10.10.2 Mattermost versions 10.5.x through 10.5.10 Mattermost versions 10.11.x through 10.11.2 Description The software does not properly validate email ownership during a Slack import process. This allows...

CVE-2025-41410: Missing Authorization

Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictio...

CVE-2025-10051

The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...

EUVD-2025-34560

The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...

CVE-2025-10051 Demo Import Kit <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload

The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...

CVE-2025-10051 Demo Import Kit <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload

The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...

CVE-2025-10051

CVE-2025-10051 affects the WordPress plugin “Demo Import Kit” (versions ≤ 1.1.0). The vulnerability is an authenticated arbitrary file upload due to missing file type validation in the import function, enabling an Administrator+ attacker to upload arbitrary files to the server and potentially ach...

WordPress Demo Import Kit plugin <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload vulnerability

Authenticated Admin+ Arbitrary File Upload vulnerability discovered by vodanh in WordPress Plugin Demo Import Kit versions = 1.1.0...

WordPress plugin Demo Import Kit 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. An arbitrary file upload vulnerability exists in the WordPress Demo Import Kit plugin, which stems from a lack of file type validation in the import function and can be exploite...