SUSE CVE-2017-18895

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information user statuses via a REST API version 4 endpoint...

PT-2026-3226

The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to order status manipulation due to insufficient verification of data authenticity in all versions up to, and including, 5.1.2. This is due to the plugin failing to verify the authenticity of payment callbacks. This makes it possibl...

CVE-2026-22643

creationtimestamp| type| source ---|---|--- 2026-01-15 14:43:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mchsz6yior2f 2026-01-15 14:43:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mchszz4er322 2026-01-15 15:12:34+00:00| seen|...

PT-2026-2818

The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm get email recipients and wpcrm system ajax task change status AJAX functions in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers,...

CVE-2024-2110

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers...

GHSA-6MQ8-RVHQ-8WGG

creationtimestamp| type| source ---|---|--- 2026-01-05 22:14:04+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115844791950366444 2026-01-05 23:05:33+00:00| published-proof-of-concept| Telegram/SaQdu2HuKivKnxzQDHW0crSXnl1eIl3nAV9Cs1OYgaU4ueA 2026-01-06 03:55:16+00:00| seen|...

CVE-2025-14762

creationtimestamp| type| source ---|---|--- 2025-12-17 20:38:12+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115736831023453482 2025-12-17 20:38:24+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115736831846545668 2025-12-19 12:00:58+00:00| seen|...

CVE-2025-12963

creationtimestamp| type| source ---|---|--- 2025-12-12 04:34:36+00:00| seen| https://infosec.exchange/users/offseq/statuses/115704730410222311 2025-12-12 04:34:37+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m7rb5pqz5r2j 2025-12-12 05:25:47+00:00| seen|...

CVE-2025-56099

creationtimestamp| type| source ---|---|--- 2025-12-11 18:45:50+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115702415200356592...

CVE-2025-42928

creationtimestamp| type| source ---|---|--- 2025-12-09 03:05:12+00:00| seen| https://infosec.exchange/users/offseq/statuses/115687391958582450 2025-12-09 03:05:13+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m7jkr4b2k62s 2025-12-09 03:10:12+00:00| seen|...

CVE-2025-12850

creationtimestamp| type| source ---|---|--- 2025-12-05 08:33:53+00:00| seen| https://infosec.exchange/users/offseq/statuses/115666035106208552 2025-12-05 08:33:54+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m7a3b4yyml2t 2025-12-05 12:22:55+00:00| seen|...

CVE-2025-12355 Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update

The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxnoprivupdateorderstatus' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses...

PT-2025-49226

The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp ajax nopriv update order status' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses...

CVE-2025-2486

creationtimestamp| type| source ---|---|--- 2025-11-26 17:48:42+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115617256049609173 2026-01-06 01:35:56+00:00| seen| https://bsky.app/profile/bluesky.awakari.com/post/3mbpsta6drg2p 2026-01-06 01:36:08+00:00| seen|...

CVE-2025-59245

creationtimestamp| type| source ---|---|--- 2025-11-20 22:44:19+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115584444564008370 2025-11-20 23:25:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m63w3zlo3z2q 2025-11-21 01:33:17+00:00| seen|...

CVE-2025-62293

SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55...

EUVD-2025-198311

SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55...

CVE-2023-41346

creationtimestamp| type| source ---|---|--- 2025-11-19 21:59:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115578606002979278 2025-11-19 22:00:06+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115578608301178805 2025-11-20 21:02:46+00:00| seen|...

CVE-2023-41348

creationtimestamp| type| source ---|---|--- 2025-11-19 21:59:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115578606002979278 2025-11-19 22:00:06+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115578608301178805 2025-11-20 21:02:47+00:00| seen|...

Mastodon 代码问题漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A code issue vulnerability exists in Mastodon versions prior to 4.4.8 and prior to 4.5.0-beta.2, which stems from not properly handling reposting statuses and could lead to bypassing the reference...