CVE-2025-62293: Missing Authorization

SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55...

PT-2025-47598

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.55 Description SOPlanning is susceptible to a Stored Cross-Site Scripting XSS issue within the /status endpoint. An attacker possessing an account can inject arbitrary HTML and JavaScript code into the website...

SOPlanning security vulnerabilities

SOPlanning is a suite of online project management software from SOPlanning, Inc. A security vulnerability exists in SOPlanning versions prior to 1.55, which stems from a lack of permission checking in the /status endpoint that could lead to improper access control...

CVE-2025-62729: Improper Neutralization of Input During Web Page Generation

SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. This issue was fixed in version 1.55...

PT-2025-47710

Name of the Vulnerable Software and Affected Versions Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress versions through 4.9.1 Description The Schedule Post Changes With PublishPress Future plugin for WordPress has a fl...

CVE-2023-41345

creationtimestamp| type| source ---|---|--- 2025-11-19 21:59:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115578606002979278 2025-11-19 22:00:06+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115578608301178805 2025-11-20 08:08:05+00:00| seen|...

CVE-2023-41348

creationtimestamp| type| source ---|---|--- 2025-11-19 21:59:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115578606002979278 2025-11-19 22:00:06+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115578608301178805 2025-11-20 21:02:47+00:00| seen|...

GCVE-1-2025-0018

creationtimestamp| type| source ---|---|--- 2025-11-19 19:24:11+00:00| seen| https://social.circl.lu/users/circl/statuses/115577995327441441...

CVE-2025-65025

creationtimestamp| type| source ---|---|--- 2025-11-19 19:08:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5yxb4sbgn2k...

GHSA-5HHX-V7F6-X7GV

creationtimestamp| type| source ---|---|--- 2025-11-19 17:41:47+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115577592659326077...

CVE-2025-13400

creationtimestamp| type| source ---|---|--- 2025-11-19 17:21:59+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115577514792992435 2025-11-19 19:44:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5yzcakg7r2q...

CVE-2025-63878

creationtimestamp| type| source ---|---|--- 2025-11-19 17:11:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5yqqa4ap32x...

CVE-2025-9977

Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. SQL injection attacks might also be feasible, although so far creating a working exploit has been...

CVE-2025-63218

creationtimestamp| type| source ---|---|--- 2025-11-19 15:14:10+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115577012235338015...

CVE-2025-63217

creationtimestamp| type| source ---|---|--- 2025-11-18 22:07:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115572975136035514...

CVE-2025-63258

creationtimestamp| type| source ---|---|--- 2025-11-18 19:23:49+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115572331588232554...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the Agents plugin process. An attacker can access information about when users have read channels by querying channel member objects. Remediation Upgrade...

CVE-2025-63604

creationtimestamp| type| source ---|---|--- 2025-11-18 17:39:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5wbtjysco2s...

CVE-2025-9977

Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. SQL injection attacks might also be feasible, although so far creating a working exploit has been...

CVE-2025-55074

Mattermost versions 10.11.x = 10.11.3, 10.5.x = 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects...