Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8e7831c5-2262-42c9-9655-a43ef2dac54f?source=cve - https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.7/ad-inserter.php#L9870 - https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.7/ad-inserter.php#L9333
CVE ID: CVE-2025-11746 State: PUBLISHED Published: 2025-10-15T02:26:27.267Z Last Updated: 2025-10-15T18:39:07.749Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: 8theme Products: XStore Problem Types: CWE-22 Description: The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve
execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2a49db7f-62fc-472d-9edf-de5edbe48219?source=cve - https://xstore.8theme.com/update-history/
CVE ID: CVE-2025-11748 State: PUBLISHED Published: 2025-11-08T03:27:49.308Z Last Updated: 2025-11-11T14:25:32.416Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: itthinx Products: Groups Problem Types: CWE-639 Description: The Groups plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0 via the 'group_id' parameter of the group_join function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to register for groups other than ones set in the shortcode. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
ve, to register for groups other than ones set in the shortcode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d0f6d28a-d5ca-4700-bc61-f2dd20f06fcf?source=cve - https://plugins.trac.wordpress.org/browser/groups/trunk/lib/views/class-groups-shortcodes.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387846%40groups&new=3387846%40groups&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11749 State: PUBLISHED Published: 2025-11-05T05:31:25.156Z Last Updated: 2025-11-05T14:39:43.748Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: tigroumeow Products: AI Engine Problem Types: CWE-200 Description: The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, l
hich can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/06eaf624-aedf-453d-8457-d03a572fac0d?source=cve - https://plugins.trac.wordpress.org/browser/ai-engine/trunk/labs/mcp.php#L226 - https://plugins.trac.wordpress.org/changeset/3380753/ai-engine#file10
CVE ID: CVE-2025-11750 State: PUBLISHED Published: 2025-10-22T13:13:32.493Z Last Updated: 2025-10-22T14:10:12.644Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: langgenius Products: langgenius/dify Problem Types: CWE-544 Description: In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system responds with a message such as "account not found." Conversely, when the username or email exists but the password is incorrect, a diffe
essage such as "account not found." Conversely, when the username or email exists but the password is incorrect, a different error message is returned. This discrepancy allows an attacker to enumerate valid user accounts by analyzing the error responses, potentially facilitating targeted social engineering, brute force, or credential stuffing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e7359f9f-c004-4304-9de9-753622d370a1
CVE ID: CVE-2025-11753 State: PUBLISHED Published: 2025-11-04T04:27:23.226Z Last Updated: 2025-11-04T14:56:56.689Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: augustinfotech Products: Bootstrap Multi-language Responsive Portfolio Problem Types: CWE-79 Description: The Bootstrap Multi-language Responsive Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute w
attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e016213f-b06f-4a9d-a2c6-3b4dd1b6b571?source=cve - https://wordpress.org/plugins/bootstrap-multi-language-responsive-portfolio/ - https://plugins.svn.wordpress.org/bootstrap-multi-language-responsive-portfolio/trunk/wpt-posttype-portfolio.php
CVE ID: CVE-2025-11755 State: PUBLISHED Published: 2025-11-01T06:40:39.047Z Last Updated: 2025-11-03T13:30:34.941Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpdelicious Products: WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) Problem Types: CWE-434 Description: The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import p
at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/603210ca-7231-4c91-8258-fe3cd6e37425?source=cve - https://plugins.trac.wordpress.org/browser/delicious-recipes/trunk/src/api/inc/endpoints/class-delicious-recipes-rest-import-recipe-terms-controller.php
CVE ID: CVE-2025-11756 State: PUBLISHED Published: 2025-11-06T22:26:20.265Z Last Updated: 2025-11-08T04:55:17.540Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_14.html - https://issues.chromium.org/issues/447192722
CVE ID: CVE-2025-11757 State: PUBLISHED Published: 2025-10-21T17:24:54.398Z Last Updated: 2025-10-21T18:29:00.590Z Vendors: CloudEdge Products: CloudEdge App Problem Types: CWE-155 Description: The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard to receive all the messages that should be delivered to other users by subscribing to the a MQTT topic. In these messages, the attacker can obtain the credentials and key information to connect to the cameras from peer to peer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-294-05
CVE ID: CVE-2025-11758 State: PUBLISHED Published: 2025-11-04T04:27:15.403Z Last Updated: 2025-11-04T21:00:48.168Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: codebangers Products: All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier Problem Types: CWE-862 Description: The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying only on a nonce check without capability checks. This makes it possible fo
sers via wp_ajax_nopriv_ hooks, while relying only on a nonce check without capability checks. This makes it possible for unauthenticated attackers to create published pages, create shift records with integrity issues, and download time reports containing PII (employee names and work schedules). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28246279-ecd8-4731-a4cc-64a3a4167323?source=cve - https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L26 - https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L442 - https
- https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L442 - https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L1447
CVE ID: CVE-2025-11760 State: PUBLISHED Published: 2025-10-25T01:45:55.977Z Last Updated: 2025-10-27T15:57:29.737Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wpcenter Products: eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams Problem Types: CWE-200 Description: The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting view template. This makes it possible for unauthenticated attackers to extract the
nt-side JavaScript within the meeting view template. This makes it possible for unauthenticated attackers to extract the sdk_secret value, which should remain server-side, compromising the security of the Zoom integration and allowing attackers to generate valid JWT signatures for unauthorized meeting access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0baaa6b7-3884-465e-bae3-46edab6312d4?source=cve - https://plugins.trac.wordpress.org/browser/eroom-zoom-meetings-webinar/tags/1.5.6/templates/single/meeting_view.php#L173 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3379064%40er
le/meeting_view.php#L173 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3379064%40eroom-zoom-meetings-webinar%2Ftrunk&old=3375935%40eroom-zoom-meetings-webinar%2Ftrunk&sfp_email=&sfph_mail=#file4
CVE ID: CVE-2025-11761 State: PUBLISHED Published: 2025-11-03T15:13:39.263Z Last Updated: 2025-11-04T04:55:15.307Z Vendors: HP Inc Products: HP Client Management Script Library Problem Types: CWE-427 Description: A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during the installation process. HP is releasing software updates to mitigate the potential vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_13187651-13187675-16/hpsbhf04058
CVE ID: CVE-2025-11763 State: PUBLISHED Published: 2025-11-21T07:31:57.219Z Last Updated: 2025-11-21T14:56:23.343Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rustybadrobot Products: Display Pages Shortcode Problem Types: CWE-79 Description: The Display Pages Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column_count' parameter in the [display-pages] shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execu
thenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/df4ada5f-6008-40b9-ad83-c6af82e64e9f?source=cve - https://plugins.trac.wordpress.org/browser/display-pages-shortcode/trunk/display-pages-shortcode.php#L513 - https://plugins.trac.wordpress.org/browser/display-pages-shortcode/trunk/display-pages-shortcode.php#L517
CVE ID: CVE-2025-11764 State: PUBLISHED Published: 2025-11-21T07:31:56.294Z Last Updated: 2025-11-21T14:56:33.904Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fastmover Products: Shortcodes Bootstrap Problem Types: CWE-79 Description: The Shortcodes Bootstrap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in the [notification] shortcode in all versions up to, and including, 1.1. This is due to missing input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acces
ith contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9363db7-4535-427d-a6ae-2580f215b965?source=cve - https://plugins.trac.wordpress.org/browser/shortcodes-bootstrap/trunk/inc/dws_alert.php#L16
CVE ID: CVE-2025-11765 State: PUBLISHED Published: 2025-11-21T07:31:47.919Z Last Updated: 2025-11-21T14:57:18.416Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: developdaly Products: Stock Tools Problem Types: CWE-79 Description: The Stock Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_height' and 'image_width' shortcode attributes in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ntributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d852dba-39ea-4cc9-9fcf-7f2ac3e1b5d0?source=cve - https://plugins.trac.wordpress.org/browser/stock-tools/tags/1.1/stock-tools.php#L67
CVE ID: CVE-2025-11767 State: PUBLISHED Published: 2025-11-21T07:31:49.546Z Last Updated: 2025-11-21T14:56:56.155Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fpcorso Products: Tips Shortcode Problem Types: CWE-79 Description: The Tips Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tip' shortcode in all versions up to, and including, 0.2.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/34c13495-23c3-4b07-9bfb-678723daa43f?source=cve - https://plugins.trac.wordpress.org/browser/tips-shortcode/tags/0.2.1/tips_shortcode.php#L33
CVE ID: CVE-2025-11768 State: PUBLISHED Published: 2025-11-21T07:31:50.312Z Last Updated: 2025-11-24T18:07:12.523Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: darto Products: Islamic Phrases Problem Types: CWE-79 Description: The Islamic Phrases plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phrases' shortcode attribute in all versions up to, and including, 2.12.2015. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9bcc72-e434-4f6f-9e90-eec8cad31035?source=cve - https://plugins.trac.wordpress.org/browser/islamic-phrases/tags/2.12.2015/islamic-phrases.php#L89
CVE ID: CVE-2025-11769 State: PUBLISHED Published: 2025-11-13T08:27:48.069Z Last Updated: 2025-11-13T18:12:37.091Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: aumsrini Products: WordPress Content Flipper Problem Types: CWE-79 Description: The WordPress Content Flipper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bgcolor' shortcode attribute of the 'flipper_front' shortcode in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will e
r authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d591a6-4bbe-435b-aef6-ed176c42dca2?source=cve - https://plugins.trac.wordpress.org/browser/wp-flipper/tags/0.1/wp-flipper.php#L144 - https://plugins.trac.wordpress.org/browser/wp-flipper/tags/0.1/wp-flipper.php#L258
CVE ID: CVE-2025-11770 State: PUBLISHED Published: 2025-11-21T07:31:49.929Z Last Updated: 2025-11-24T18:08:19.783Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: billybigpotatoes Products: BrightTALK WordPress Shortcode Problem Types: CWE-79 Description: The BrightTALK WordPress Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the brighttalk-time shortcode in all versions up to, and including, 2.4.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i
akes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e3b5433-e17b-4ece-9e5c-ef4d818068dc?source=cve - https://plugins.trac.wordpress.org/browser/brighttalk-wp-shortcode/tags/2.4.0/brighttalk-wp-shortcode.php#L130
CVE ID: CVE-2025-11771 State: PUBLISHED Published: 2025-11-21T07:31:55.521Z Last Updated: 2025-11-21T14:56:45.347Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: beycanpress Products: Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO Problem Types: CWE-306 Description: The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to manipulat
function in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to manipulate presales counters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c5793f-4d98-4ec1-a9b6-6e7c3f8b6099?source=cve - https://plugins.trac.wordpress.org/browser/tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop/tags/2.4.6/app/RestAPI.php#L275
CVE ID: CVE-2025-11773 State: PUBLISHED Published: 2025-11-21T07:31:57.590Z Last Updated: 2025-11-21T14:56:17.486Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: beycanpress Products: Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO Problem Types: CWE-862 Description: The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveDeployedContract' function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to over
nd including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the WordPress option `tokenico_deployed_contracts`, poisoning the smart contract addresses displayed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e02597b1-eea6-4fdd-baeb-527201d1c61f?source=cve - https://plugins.trac.wordpress.org/browser/tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop/tags/2.4.6/app/RestAPI.php#L108
CVE ID: CVE-2025-11776 State: PUBLISHED Published: 2025-11-14T07:58:52.172Z Last Updated: 2025-11-14T15:49:13.309Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates