CVE-2025-22206

CVE-2025-22206 affects the Joomla JS Jobs plugin versions 1.1.5–1.4.2. The underlying issue is a SQL injection in the GDPR Field feature via the fieldfor parameter, allowing an authenticated administrator to execute arbitrary SQL commands. The vulnerability is confirmed across multiple sources in...

CVE-2025-1015

The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book,...

CVE-2025-0510

Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability affects Thunderbird 128.7 and Thunderbird 135...

DEBIAN-CVE-2025-0510

Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135...

UBUNTU-CVE-2025-0510

Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability affects Thunderbird 128.7 and Thunderbird 135...

Jenkins Zoom Plugin is Missing Password Field Masking

Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access...

GHSA-4352-JXWG-88RM Jenkins Zoom Plugin is Missing Password Field Masking

Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access...

PT-2025-4390 · Joomla · Js Jobs Plugin

Name of the Vulnerable Software and Affected Versions: JS Jobs plugin versions 1.1.5 through 1.4.2 for Joomla Description: A SQL injection issue allows authenticated attackers, specifically administrators, to execute arbitrary SQL commands. This is achieved via the fieldfor parameter in the GDPR...

PT-2025-1582 · Supermicro · Supermicro Mbd-X12Dpg-Oa6

Name of the Vulnerable Software and Affected Versions: Supermicro MBD-X12DPG-OA6 affected versions not specified Description: A security issue exists in the firmware image verification implementation. An attacker with administrator privileges can upload a specially crafted image, causing a stack...

Joomla! 安全漏洞

Joomla! is a free, open source content management system from Joomla! A security vulnerability exists in Joomla! JS Jobs versions 1.1.5 through 1.4.2, which stems from the presence of a SQL injection vulnerability that allows an authenticated attacker to execute arbitrary SQL commands via the...

Important: runfinch-finch

Issue Overview: Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to...

Mozilla Thunderbird 安全漏洞

Mozilla Thunderbird is a suite of e-mail client software from the Mozilla Foundation in the United States that is separate from the Mozilla Application Suite. The software supports the IMAP and POP mail protocols as well as the HTML mail format. A security vulnerability exists in Mozilla...

Important: containerd

Issue Overview: Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to...

PT-2025-2158 · WordPress · Wpforms

Name of the Vulnerable Software and Affected Versions: WPForms – Easy Form Builder for WordPress versions up to, and including, 1.9.3.1 Description: The issue is related to Stored Cross-Site Scripting via the fieldHTML parameter due to insufficient input sanitization and output escaping. This...

WordPress WPForms Lite plugin <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via fieldHTML Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin Contact Form by WPForms versions = 1.9.3.1...

CVE-2025-0148

CVE-2025-0148 (Zoom Jenkins Marketplace plugin) : A defect in the Zoom Jenkins Marketplace plugin up to version 1.6 allows information disclosure due to missing password field masking, exploitable by an unauthenticated actor via adjacent network access. Vulnerable component: Zoom Jenkins Marketpl...

CVE-2025-22129 Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an unauthorized user might get access to restricted information. This issue has been addressed in Tuleap Community Edition 16.3.99.1736242932, Tuleap Enterprise Edition 16.2-5, an...

CVE-2024-57175

A Stored Cross-Site Scripting XSS vulnerability was identified in the PHPGURUKUL Online Birth Certificate System v1.0 via the profile name to /user/certificate-form.php...

PT-2025-3005 · Nradio · Nradio N8-180 Nros

Name of the Vulnerable Software and Affected Versions: NRadio N8-180 NROS version 1.9.2.n3.c5 Description: An issue was discovered in NRadio devices, where the "/cgi-bin/luci/nradio/basic/radio" endpoint is vulnerable to XSS via the 2.4 GHz and 5 GHz name parameters. This allows an attacker to...

PT-2025-3407 · Unknown · Phpgurukul Online Birth Certificate System

Name of the Vulnerable Software and Affected Versions: PHPGURUKUL Online Birth Certificate System version 1.0 Description: A Stored Cross-Site Scripting XSS issue was identified in the PHPGURUKUL Online Birth Certificate System. The issue arises via the profile name to the...