GHSA-56P6-QW3C-FQ2G Suspended Directus user can continue to use session token to access API

Summary Since the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to access the API despite their status. Details There is a check missing in verifySessionJWT to verify that a user is actually still active and allowed to...

CVE-2022-34444

creationtimestamp| type| source ---|---|--- 2025-03-26 15:26:07+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8863...

CVE-2024-30570

creationtimestamp| type| source ---|---|--- 2025-03-26 12:41:34+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-30570.yaml 2025-03-27 21:02:06+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3llf73ztmhl2s...

CVE-2024-30569

creationtimestamp| type| source ---|---|--- 2025-03-26 12:40:48+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-30569.yaml 2025-03-27 21:02:06+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3llf73zrfnu2z...

CVE-2025-29789

creationtimestamp| type| source ---|---|--- 2025-03-25 21:25:39+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8786 2025-03-25 23:40:33+00:00| seen| https://t.me/cvedetector/21121 2025-03-26 01:04:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llalpbmmy...

CVE-2025-27834

creationtimestamp| type| source ---|---|--- 2025-03-25 20:24:11+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8749 2025-03-25 23:40:45+00:00| seen| https://t.me/cvedetector/21129 2025-03-26 01:05:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llalqxaksp2l...

CVE-2025-1449

creationtimestamp| type| source ---|---|--- 2025-03-25 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-02 2025-03-31 16:33:27+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/9701 2025-03-31 16:44:25+00:00| seen|...

CVE-2025-2754

creationtimestamp| type| source ---|---|--- 2025-03-25 09:24:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8629 2025-03-25 10:01:07+00:00| published-proof-of-concept| Telegram/d874YtfjRzSeJrj5ty8uatKWcKwQKjZYN7PQfn69YdZXOI 2025-03-25 10:54:30+00:00| seen|...

CVE-2025-2752

creationtimestamp| type| source ---|---|--- 2025-03-25 08:23:36+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8625 2025-03-25 11:08:10+00:00| seen| https://t.me/cvedetector/21081 2026-02-14 23:26:13+00:00| seen|...

CVE-2024-10207

creationtimestamp| type| source ---|---|--- 2025-03-25 06:57:07+00:00| seen| https://t.me/cvedetector/21044 2025-04-03 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-05...

CVE-2025-2224

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parsequery' function in all versions up to, and including, 8.2. This makes it possible fo...

CVE-2025-2764

creationtimestamp| type| source ---|---|--- 2025-03-25 04:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-178/ 2025-04-23 19:48:33+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114389005957491891 2025-04-23 20:14:31+00:00| seen|...

CVE-2025-2772

creationtimestamp| type| source ---|---|--- 2025-03-25 04:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-185/ 2025-04-23 18:00:02+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114388579201738740 2025-04-23 21:10:16+00:00| seen| https://t.me/cvedetector/23599...

CVE-2025-2726

creationtimestamp| type| source ---|---|--- 2025-03-25 02:23:18+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8580 2025-03-25 04:01:20+00:00| published-proof-of-concept| Telegram/MXLtd6D6lDs-X3W-toegTHLzYyO4SelR8FKZM3tOB5yKLoA 2025-03-25 04:48:23+00:00| seen|...

CVE-2022-45766

creationtimestamp| type| source ---|---|--- 2025-03-24 18:22:56+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8491...

CVE-2025-1097

creationtimestamp| type| source ---|---|--- 2025-03-24 17:55:00+00:00| seen| https://thehackernews.com/2025/03/critical-ingress-nginx-controller.html 2025-03-24 21:56:48+00:00| seen| https://bsky.app/profile/lookitup.baby/post/3ll5qr5t6uk2k 2025-03-24 22:01:06+00:00| seen|...

CVE-2025-29294

creationtimestamp| type| source ---|---|--- 2025-03-24 16:39:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ll56zvvuiq2x 2025-03-24 18:24:24+00:00| seen| https://t.me/cvedetector/20974...

CVE-2025-30569

creationtimestamp| type| source ---|---|--- 2025-03-24 14:48:31+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114217956819669903 2025-03-24 16:39:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ll56zx6t2a2s 2025-03-31 18:31:58+00:00| published-proof-of-concept...

CVE-2025-2675

creationtimestamp| type| source ---|---|--- 2025-03-24 02:31:04+00:00| published-proof-of-concept| Telegram/TxYF2rNxgao0QlSERqOAIAGczvgtgedogrr1QU2ew4YiRfY 2025-03-24 04:11:17+00:00| seen| https://t.me/cvedetector/20930 2025-03-24 04:23:58+00:00| seen|...

CVE-2025-2663

creationtimestamp| type| source ---|---|--- 2025-03-24 00:00:33+00:00| seen| https://t.me/cvedetector/20922 2025-03-24 00:19:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ll3ibwbvil2l...