MAL-2025-2905 Malicious code in team-labeler-action (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-31440

CVE-2025-31440 is a CSRF vulnerability in Strategy11 Terms of Use plugin that allows Stored XSS. Affected software: Terms of Use (Strategy11) plugin up to version 2.0. Reported impact: cross-site request forgery enabling stored XSS in eligible requests. CVSS v3.1 base score 7.1 (HIGH); vectors: A...

BIT-MATTERMOST-2025-27715

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

CVE-2025-24381

creationtimestamp| type| source ---|---|--- 2025-03-28 03:27:39+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/9263 2025-03-28 05:00:36+00:00| seen| Telegram/REIy8s9RHKd3lCpUQgU1ZLtNB2gCBYg9aoCqFnV7Mh0QfY 2025-03-28 05:12:10+00:00| seen| https://t.me/cvedetector/21359 2025-03-28 09:05:40+00:0...

CVE-2025-31092

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget support-chat allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through = 2.3.4...

Mattermost Server 9.11.x < 9.11.9 (MMSA-2024-00409)

The version of Mattermost Server installed on the remote host is prior to 9.11.9. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00409 advisory. - Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel...

CVE-2025-31092

CVE-2025-31092: Stored XSS in Click to Chat – WP Support All-in-One Floating Widget due to improper input neutralization during web page generation; affected plugin versions up to 2.3.4 (no details on fixes in provided documents).

CVE-2025-30093

creationtimestamp| type| source ---|---|--- 2025-03-27 20:50:26+00:00| seen| https://t.me/cvedetector/21334 2025-03-28 15:28:33+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/9365 2025-03-28 20:49:11+00:00| seen| https://bsky.app/profile/redteamnews.bsky.social/post/3llhotwpwb52j...

CVE-2025-30868

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Maidul Team Manager wp-team-manager allows PHP Local File Inclusion.This issue affects Team Manager: from n/a through = 2.1.23...

CVE-2025-30868

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Maidul Team Manager wp-team-manager allows PHP Local File Inclusion.This issue affects Team Manager: from n/a through = 2.1.23...

WordPress Team Manager plugin <= 2.1.23 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Team Manager versions = 2.1.23...

CVE-2025-30868 WordPress Team Manager plugin <= 2.1.23 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Maidul Team Manager wp-team-manager allows PHP Local File Inclusion.This issue affects Team Manager: from n/a through = 2.1.23...

CVE-2025-30868 WordPress Team Manager plugin <= 2.1.23 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Maidul Team Manager wp-team-manager allows PHP Local File Inclusion.This issue affects Team Manager: from n/a through = 2.1.23...

CVE-2025-30868

CVE-2025-30868 concerns the Team Manager plugin for WordPress. The vulnerability is Local File Inclusion via an improper include/require in a PHP component, leading to potential code exposure or execution. It affects Team Manager up to version 2.1.23 and is exploitable by an authenticated attacke...

WordPress Our Team Members plugin <= 2.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Anhchangmutrang in WordPress Plugin Our Team Members versions = 2.2...

Mattermost Authorization Issues Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an authorization issue vulnerability that stems from improper authorization of the Viewer role, which can be exploited by an attacker to still view team and site statistics...

WordPress plugin Team Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Sensitive Information Disclosure

LiteLLM is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper error handling due to an issue in proxyserver.py that leaks Langfuse API keys when an error occurs while parsing team settings, potentially exposing full access to stored requests...

GO-2025-3555 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server

Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server...

Malicious code in team-bsb-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: oracle-using-macaron da5627aaacdf2bd8ab0ce2e469ea8635108e857776ed8766ee9df47c4b66aaa8 This package appears to be part of a larger ecosystem acting as a placeholder for orchestrating interactions with other bsb malicious packages...