PT-2025-40546

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 5.0.0.1 Description A flaw exists in Qsync Central where unrestricted resource allocation can occur. A remote attacker who obtains a user account may be able to prevent other systems, applications, or processes...

PT-2025-40530

Name of the Vulnerable Software and Affected Versions MotionEye versions 0.43.1b4 and earlier Description MotionEye is susceptible to a command injection issue that allows attackers to achieve Remote Code Execution RCE. The vulnerability arises because MotionEye writes user-supplied values direct...

SUSE CVE-2025-54292

Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths...

CVE-2025-54292 Client-Side Path Traversal in LXD-UI

Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths...

CVE-2025-10131

The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-10168

CVE-2025-10168 — WordPress Any News Ticker plugin stores cross-site scripting via the any-ticker shortcode. All versions up to 3.1.1 are affected due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authentic access at contributor level or ...

CVE-2025-10179

CVE-2025-10179 – My AskAI (WordPress) – Stored XSS . Affected: My AskAI WordPress plugin; vulnerable component is the myaskai shortcode. Root cause: insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers with contributor-level access can i...

NewStart CGSL MAIN 6.06 : dbus Multiple Vulnerabilities (NS-SA-2025-0236)

The remote NewStart CGSL host, running version MAIN 6.06, has dbus packages installed that are affected by multiple vulnerabilities: - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and...

PT-2025-39939

Name of the Vulnerable Software and Affected Versions All in One Music Player plugin for WordPress versions prior to 1.3.2 Description The All in One Music Player plugin for WordPress is susceptible to a Path Traversal issue through the theme parameter. This allows authenticated attackers with...

PT-2025-40036

Multiple stored cross-site scripting XSS vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows remote authenticated attackers to inject arbitrar...

CVE-2025-57876

CVE-2025-57876 is a stored XSS vulnerability in Esri Portal for ArcGIS 11.4 and earlier. An authenticated attacker with high privileges can inject a file containing an XSS script; when loaded, it could execute arbitrary JavaScript in the victim’s browser and potentially disclose a privileged toke...

CVE-2025-57876 Stored XSS vulnerability in Portal for ArcGIS

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The...

PT-2025-39906

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.50 through 7.4.3.111 Liferay DXP versions 2023.Q3.1 through 2023.Q3.7 Liferay DXP versions 2023.Q4.0 through 2023.Q4.4 Liferay DXP 7.4 update 50 through update 92 Description The software contains multiple stored...

PT-2025-39514

Name of the Vulnerable Software and Affected Versions TweetThis Shortcode plugin for WordPress versions prior to 1.8.1 Description The TweetThis Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'tweetthis' shortcode. Insufficient input sanitization and outp...

CVE-2025-36037

IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2025-57682

Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket through its CloudFront distribution via the "POST /api/file/s3/get-presigned-get-url-proxy" API...

CVE-2025-36037 IBM webMethods Integration server-side request forgery

IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2025-10305

The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

PT-2025-38757

Name of the Vulnerable Software and Affected Versions ARD affected versions not specified Description An Insecure Direct Object Reference IDOR vulnerability exists in ARD. The flaw is located in the fe uid parameter of the payment history API endpoint. An authenticated attacker can manipulate thi...

CVE-2025-26517

StorageGRID formerly StorageGRID Webscale versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerability. Successful exploit could allow an unauthorized authenticated attacker to discover Grid node names and IP addresses or modify Storage Grades...