GHSA-8FRV-Q972-9RQ5

creationtimestamp| type| source ---|---|--- 2025-11-25 20:14:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115612168819994275...

CVE-2025-12816

creationtimestamp| type| source ---|---|--- 2025-11-25 19:50:17+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115612071838011122 2025-11-25 22:20:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6ies2nbe22w 2025-11-27 09:16:04+00:00| seen|...

GO-2025-4133 Mattermost allows other users to determine when users had read channels via channel member objects in github.com/mattermost/mattermost-server

Mattermost allows other users to determine when users had read channels via channel member objects in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

CVE-2024-59373

creationtimestamp| type| source ---|---|--- 2025-11-25 15:05:24+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115610951630509357...

CVE-2025-13016

creationtimestamp| type| source ---|---|--- 2025-11-25 12:46:33+00:00| seen| https://t.me/DarkWebInformerNews/10790 2025-11-25 13:01:54+00:00| seen| https://mstdn.social/users/Hackread/statuses/115610465919493917 2025-11-25 15:55:06+00:00| seen|...

CVE-2025-12978

creationtimestamp| type| source ---|---|--- 2025-11-25 12:05:31+00:00| seen| https://gist.github.com/Darkcrai86/9c78936ffd5178a4049061473f0a3a90 2026-07-26 02:00:26+00:00| seen| https://t.me/EchelonEyes/4184 2026-07-27 00:00:09+00:00| seen| https://t.me/EchelonEyes/4184 2026-08-19 21:00:07+00:00|...

CVE-2025-13385

The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the filterstatus parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2025-12634

The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updaterefundstatus' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-12634 Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update

The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updaterefundstatus' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-13385 Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter

The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the filterstatus parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2025-13385

CVE-2025-13385 affects the WordPress plugin Bookme – Free Online Appointment Booking and Scheduling System (versions up to 4.2). The vulnerability is a time-based SQL Injection arising from insufficient escaping of the filter[status] parameter in the affected SQL query, enabling an authenticated ...

EUVD-2025-199564

The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the filterstatus parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2025-13385 Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter

The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the filterstatus parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

EUVD-2025-199565

The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updaterefundstatus' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-12634

The CVE-2025-12634 entry concerns the WordPress plugin Refund Request for WooCommerce. A missing capability check in the update_refund_status function affects all versions up to and including 1.0, allowing authenticated users with Subscriber-level access or higher to modify refund statuses to app...

EUVD-2025-199543

Not used...

EUVD-2025-199541

Not used...

EUVD-2025-199542

Not used...

CVE-2025-13558

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'deleteUserCcDraftPost' function in all versions up to, and including, 8.7.0. This makes it possible for authenticated attackers, wi...

WordPress Refund Request for WooCommerce plugin <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update vulnerability

Missing Authorization to Authenticated Subscriber+ Refund Status Update vulnerability discovered by Powpy in WordPress Plugin Refund Request for WooCommerce versions = 1.0...