CVE-2025-59450

The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials...

CVE-2025-60959

The EndRun Technologies Sonoma D12 Network Time Server (GPS) is affected by an OS Command Injection vulnerability in firmware version 6010-0071-000 Ver 4.00 . This flaw, caused by the improper neutralization of special elements used in an OS command, allows remote attackers to gain sensitive info...

SICK AG Baggage Analytics security vulnerabilities

SICK AG Baggage Analytics is a visualization and analysis software for airport tracking systems from SICK AG, Germany. A security vulnerability exists in SICK AG Baggage Analytics that stems from the possibility of brute-force breaking of folders and files, which could lead to the disclosure of...

PT-2025-40927

Name of the Vulnerable Software and Affected Versions EndRun Technologies Sonoma D12 Network Time Server GPS version 4.00 Description A Cross Site Scripting XSS issue exists in EndRun Technologies Sonoma D12 Network Time Server GPS. Successful exploitation could allow attackers to obtain sensitiv...

CVE-2025-59450

The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials...

PT-2025-40864

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The username and password are sent directly in the URL as parameters within HTTP requests. This practice poses a significant risk of sensitive data disclosure, as URLs may be stored in server logs,...

CVE-2025-60958

A Cross-Site Scripting (XSS) vulnerability exists in the EndRun Technologies Sonoma D12 Network Time Server (GPS) , specifically affecting firmware F/W 6010-0071-000 Ver 4.00 . The flaw stems from the improper neutralization of input during web page generation , which may allow an attacker to gai...

CVE-2025-60957

The EndRun Technologies Sonoma D12 Network Time Server (GPS) , specifically firmware F/W 6010-0071-000 Ver 4.00 , is susceptible to an OS Command Injection vulnerability. This flaw allows an attacker to execute arbitrary code, cause a denial of service, gain escalated privileges, and access sensi...

ROS-20251006-03

A vulnerability in a set of tools that allow companies to manage software subscriptions Candlepin is related to the ability to create data related to another client/tenant. Exploitation vulnerability could allow an attacker acting remotely to gain access to sensitive information...

ROS-20251006-13

A vulnerability in a library that provides basic functionality for data serialization and deserialization Jackson Core, is related to the fact that when parsing JSON from an array of bytes with offset and length, an exception message is erroneously read from the beginning of the array. exception...

BIT-DISCOURSE-2025-59337 Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deployments

Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixe...

CVE-2025-11227

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check...

CVE-2025-10746

The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate t...

CVE-2025-10746 Integrate Dynamics 365 CRM <= 1.0.9 - Missing Authorization

The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate t...

CVE-2025-10746

CVE-2025-10746 – Integrate Dynamics 365 CRM plugin (WordPress) affects all versions up to 1.0.9. Root cause: missing capability checks and nonce verification on functions hooked to init, enabling unauthenticated access. Impact (per sources): unauthenticated attackers can deactivate the plugin, ta...

CVE-2025-11227 GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check...

EUVD-2025-32430

A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA...

PT-2025-40614

Name of the Vulnerable Software and Affected Versions Integrate Dynamics 365 CRM plugin for WordPress versions through 1.0.9 Description The Integrate Dynamics 365 CRM plugin for WordPress is susceptible to unauthorized access due to missing capability checks and nonce verification on functions...

CVE-2025-43825

A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA...

WordPress RestroPress plugin 3.0.0-3.2.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by kr0d in WordPress Plugin RestroPress versions 3.0.0-3.2.1...