PT-2025-23169 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.12 Mattermost versions 10.5.x through 10.5.3 Mattermost versions 10.6.x through 10.6.2 Mattermost versions 10.7.x through 10.7.0 Description: The issue is related to the improper validation of permissio...

PT-2025-23170 · Maccms10 · Maccms10

Name of the Vulnerable Software and Affected Versions: maccms10 version 2025.1000.4047 Description: The issue is related to Server-side request forgery SSRF in Email Settings. This means that an attacker could potentially forge requests to internal or external services, bypassing normal security...

CVE-2025-45474

maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery SSRF in Email Settings...

GHSA-H5F8-CRRQ-4PW8 Contrast workload secrets leak to logs on INFO level

Impact When the Contrast initializer is configured with a CONTRASTLOGLEVEL of info or debug, the workload secret is logged to stderr and written to Kubernetes logs. Since info is the default setting, this affects all Contrast installations that don't customize their initializers' log level. The...

Absolute Secure Access 访问控制错误漏洞

Absolute Secure Access is an application from Absolute, Inc. to provide Secure Service Edge SSE optimized for hybrid and mobile working models. A security vulnerability exists in versions prior to Absolute Secure Access 13.54 that stems from improper authorization of the management console, which...

The vulnerability of the SINEMA Remote Connect Edge Client microprogramming software for industrial switches from Siemens, model Siemens Scalance LPE9403, allows a perpetrator to bypass authentication procedures and gain access to read and modify configuration parameters.

The vulnerability of the SINEMA Remote Connect Edge Client microprogramming software for Siemens Scalance LPE9403 industrial switches in remote connection mode is related to the ability to bypass the authentication process by using an alternative path or channel. Exploiting this vulnerability...

CVE-2024-13966

ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their passwords located under the Attendance Settings tab as "Self-Password"...

SUSE CVE-2025-2570

Mattermost versions 10.5.x = 10.5.3, 9.11.x = 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console...

WordPress Order Delivery Date Missing Authorization

WordPress Order Delivery Date plugin versions prior to 12.3.1 have missing authorization and cross site request forgery vulnerabilities surrounding the importing of settings...

NetAlertX 访问控制错误漏洞

NetAlertX is a network intruder and presence detector from the jokob-sk individual developer. An access control error vulnerability exists in NetAlertX versions prior to 25.4.14 that stems from a bypass of the authentication mechanism and could lead to an unauthorized update of settings...

CVE-2025-5126

A vulnerability was found in Teledyne FLIR AX8 up to 1.46.16. This vulnerability affects the function setDataTime of the file \usr\www\application\models\settingsregional.php. Performing manipulation of the argument year/month/day/hour/minute results in command injection. The attack may be...

CVE-2025-5124

A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects an unknown part of the component Administrative Interface. The manipulation leads to use of default credentials. It is possible to initiat...

CVE-2025-5055

The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.98 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Leadinfo plugin <= 1.1 - Settings Change Vulnerability

Settings Change Vulnerability discovered by Denver Jackson in WordPress Plugin Leadinfo versions = 1.1...

CVE-2025-4975

When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power settings of that device...

CVE-2025-5126 Teledyne FLIR AX8 settingsregional.php setDataTime command injection

A vulnerability was found in Teledyne FLIR AX8 up to 1.46.16. This vulnerability affects the function setDataTime of the file \usr\www\application\models\settingsregional.php. Performing manipulation of the argument year/month/day/hour/minute results in command injection. The attack may be...

CVE-2025-5055

The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.98 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Teledyne FLIR AX8 命令注入漏洞

Teledyne FLIR AX8 is a U.S. etc are products of the U.S. Teledyne FLIR company.Teledyne FLIR AX8 is a series of thermal surveillance cameras.TanStack form etc are products of the TanStack open source. form is a form status manager.FLIR AX8 etc are products of the U.S. FLIR AX8 is a thermal sensor...

CVE-2025-48271 WordPress Leadinfo plugin <= 1.1 - Settings Change Vulnerability

Missing Authorization vulnerability in Leadinfo Leadinfo leadinfo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadinfo: from n/a through = 1.1...

CVE-2025-24810

Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege and accessing the settings screen...