CVE-2025-12492

The CVE CVE-2025-12492 affects Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress. It exposes sensitive information via an unauthenticated AJAX endpoint (ajax_get_members) due to a low-entropy, predictable token (5 hex char...

CVE-2025-14267

Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions before 25.12.15491.7...

WordPress Ultimate Member plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Ultimate Member versions = 2.11.0...

Security Bulletin: IBM Storage Ceph is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in Golang (CVE-2024-45336)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2024-45336 Vulnerability Details CVEID:CVE-2024-45336 DESCRIPTION: The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an...

CVE-2025-62998

Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI CoPilot: from n/a through = 1.2.7...

EUVD-2025-204530

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

GHSA-R2H2-G46H-8MX8 pretix has Broken Access Control Allowing Cross-User File Access via UUID

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

EUVD-2025-204531

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

GHSA-PMJJ-H5JM-VXH4 pretix has Broken Access Control Allowing Cross-User File Access via UUID

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

CVE-2025-14882

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

CVE-2025-14881

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

CVE-2025-14437

The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials...

Authorization Bypass Through User-Controlled Key

Overview pretix is a Reinventing presales, one ticket at a time Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UUID parameter in multiple API endpoints. An attacker can access sensitive files belonging to other users by supplying the...

CVE-2025-14881 Insecure direct object reference

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

CVE-2025-14881 Insecure direct object reference

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

CVE-2025-14881

The CVE-2025-14881 issue is a broken access control in pretix (a ticketing system) where the UUID parameter in multiple API endpoints can be used to access sensitive files belonging to other users. Descriptions across Red Hat, ENISA EUVD, GHSA advisories, and the OSV/NVD entries consistently stat...

CVE-2025-14882

CVE-2025-14882 is a vulnerability in pretix (Python ticketing system) where an API endpoint allowed cross-user file access by supplying the target file’s UUID. The issue is described as an Authorization Bypass Through User-Controlled Key, enabling retrieval of sensitive files belonging to other u...

CVE-2025-14882 Insecure direct object reference

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

CVE-2025-14882 Insecure direct object reference

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

CVE-2025-12361 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure

The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...