Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 14

Export CSV
CVE-2025-13523

Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow

Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence
CVE-2025-54458

Unauthorized Subscription Creation to Confluence Space in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to create a subscription for a Confluence space the user does not have access to via the create subscription endpoint.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-53910

Unauthorized Channel Subscription Edit in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create a channel subscription without proper access to the channel via API call to the edit channel subscription endpoint.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-53857

Lack of Authorization on Get Channel Subscriptions for Autocomplete in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-53514

Unexpected Input to Server Webhook endpoint Causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-48731

Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a subscription for a Confluence space the user does not have access for via edit subscription endpoint.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-44004

Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-52931

Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-44001

Unauthorized Channel Subscription Read in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions details endpoint.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-49221

Unauthenticated Access to Channel Subscription in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to access subscription details without via API call to GET subscription endpoint.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-54463

Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-54478

Unauthenticated Channel Subscription Edit in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to edit channel subscriptions via API call to the edit channel subscription endpoint.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-54525

Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create channel subscription endpoint with an invalid request body.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost
CVE-2025-8285

Unauthorized Channel Subscription Creation in Mattermost Confluence Plugin

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Confluence Mattermost