CVE-2025-54950

creationtimestamp| type| source ---|---|--- 2025-08-07 23:37:39+00:00| seen| https://bsky.app/profile/potato.software/post/3lvtvsppgou2v 2025-08-08 01:35:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lvu4f6w6o62z 2025-08-11 15:04:41+00:00| seen|...

CVE-2025-34152

creationtimestamp| type| source ---|---|--- 2025-08-07 20:07:56+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/46935 2025-08-08 03:00:05+00:00| published-proof-of-concept| Telegram/e2h4KF19bvVdrVdcOJim51yVXX08ZKfBey7WjVNbHEXwmTU 2025-08-09 21:02:26+00:00| seen|...

CVE-2024-26189

creationtimestamp| type| source ---|---|--- 2025-08-07 02:21:03+00:00| seen| https://bsky.app/profile/nihonmatsu.bsky.social/post/3lvrohwexas2s 2025-08-07 02:21:03+00:00| seen| https://bsky.app/profile/nihonmatsu.bsky.social/post/3lvrohu2y2s2s 2025-08-07 02:21:04+00:00| seen|...

CVE-2025-54594

creationtimestamp| type| source ---|---|--- 2025-08-06 01:18:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lvp2isokrp2s 2025-08-06 01:31:42+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lvp3arpj7o2u 2025-08-06 07:58:12+00:00| seen|...

SUSE CVE-2025-6226

Mattermost versions 10.5.x = 10.5.6, 10.8.x = 10.8.1, 10.7.x = 10.7.3, 9.11.x = 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of...

CVE-2025-34147

creationtimestamp| type| source ---|---|--- 2025-08-04 20:24:13+00:00| seen| https://bsky.app/profile/undercode.bsky.social/post/3lvlzm2lq2c2c 2025-08-04 21:43:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lvm5ztoqt72s 2025-08-05 00:01:31+00:00| seen|...

CVE-2025-54387

creationtimestamp| type| source ---|---|--- 2025-08-04 07:39:33+00:00| seen| https://bsky.app/profile/pi0.io/post/3lvkouos7n22t 2025-08-04 07:39:34+00:00| seen| https://bsky.app/profile/pi0.io/post/3lvkouosigc2t 2025-08-04 07:46:22+00:00| seen| https://bsky.app/profile/pi0.io/post/3lvkpauh5ik2t...

Cross-site Scripting (XSS)

Mezzanine CMS is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization due to failure to filter user-supplied input in the /blog/blogpost/add component, allowing injection of malicious scripts into blog posts...

CVE-2025-8401

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.1 via the 'getpostdata' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive...

CVE-2025-4425

creationtimestamp| type| source ---|---|--- 2025-07-30 03:01:15+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lv5myi7qbb2d 2025-07-30 03:02:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lv5n23uovd2s...

WordPress hiWeb Export Posts Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress hiWeb Export Posts, which stems from missing or incorrect random number validation, and can be exploited by a...

Mars: SQLi at █████ parameter

A SQL injection vulnerability was discovered in an items endpoint that accepted unauthenticated POST requests without CSRF validation. The vulnerability allowed execution of arbitrary SQL commands and extraction of database metadata. Additional security issues included stored XSS through the...

CVE-2025-54768

creationtimestamp| type| source ---|---|--- 2025-07-29 00:16:07+00:00| seen| https://bsky.app/profile/nimblenerd.social/post/3lv2tcazdnq26 2025-07-29 01:10:34+00:00| seen| https://bsky.app/profile/jimbecher.bsky.social/post/3lv2wdmsm4s2k 2025-07-29 02:49:14+00:00| seen|...

WordPress plugin kallyas 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2025-8169

creationtimestamp| type| source ---|---|--- 2025-07-25 20:45:07+00:00| seen| https://bsky.app/profile/potato.software/post/3lusw43zpe52c 2025-07-25 20:45:52+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114915826085504624...

Improper Authorization

github.com/mattermost/mattermost-server is vulnerable to Improper Authorization. The vulnerability is due to a failure to verify authorization when retrieving cached posts by PendingPostID, which allows an attacker to read posts from private channels they do not have access to by guessing the...

CVE-2025-45893

OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting XSS attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded...

CVE-2025-7640 hiWeb Export Posts <= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletion

The hiWeb Export Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.0.0. This is due to missing or incorrect nonce validation on the tool-dashboard-history.php file. This makes it possible for unauthenticated attackers to delete...

PT-2025-30653 · WordPress · Hiweb Export Posts

Name of the Vulnerable Software and Affected Versions: hiWeb Export Posts plugin for WordPress versions up to and including 0.9.0.0 Description: The hiWeb Export Posts plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...

WordPress plugin hiWeb Export Posts 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress hiWeb Export Posts, which stems from missing or incorrect random number validation, and can be exploited by a...