CVE-2025-8877 AffiliateWP <= 2.28.2 - Unauthenticated SQL Injection

The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajaxgetaffiliateidfromlogin function in all versions up to, and including, 2.28.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-52047

Frappe ErpNext version 15.57.5 is vulnerable to a SQL Injection flaw in the get_income_account() function located at erpnext/controllers/queries.py. The root cause is a lack of validation for externally entered SQL statements within the filters.disabled parameter. An attacker can exploit this by ...

CVE-2025-52047

In Frappe ErpNext v15.57.5, the function getincomeaccount at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter...

CVE-2025-52047

In Frappe ErpNext v15.57.5, the function getincomeaccount at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter...

PT-2025-39990

Name of the Vulnerable Software and Affected Versions Frappe ErpNext version 15.57.5 Description The get income account function at erpnext/controllers/queries.py is susceptible to SQL Injection. An attacker can inject a SQL query into the filters.disabled parameter, potentially allowing extracti...

CVE-2025-34225 Vasion Print (formerly PrinterLogic) SSRF via console_release Directory

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 VA/SaaS deployments contain a server-side request forgery SSRF vulnerability. The consolerelease directory is reachable from the internet without any authentication. Insi...

CVE-2025-34233 Vasion Print (formerly PrinterLogic) Insecure Use of file_get_contents()

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 VA/SaaS deployments contain a protection mechanism failure vulnerability within the filegetcontents function. When an administrator configures a printer’s hostname or...

USN-7785-1 open-vm-tools vulnerability

It was discovered that Open VM Tools incorrectly handled permissions with version checking. An attacker could possibly use this issue to escalate privileges inside a virtual machine. This update disables the SDMP get-versions.sh script, so version information may no longer be made available...

USN-7785-1: Open VM Tools vulnerability

It was discovered that Open VM Tools incorrectly handled permissions with version checking. An attacker could possibly use this issue to escalate privileges inside a virtual machine. This update disables the SDMP get-versions.sh script, so version information may no longer be made available...

kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: Ensure scpiinfo is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the scpiinfo is not set and will remain NULL until the probe succeeds. If it is not taken care, the...

DEBIAN-CVE-2025-11146

Reflected Cross-site scripting XSS in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts XSS in the web management application. The vulnerability is caused by improper handling of GET inputs included in the URL in “/acng-report.html”...

UBUNTU-CVE-2025-11146

Reflected Cross-site scripting XSS in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts XSS in the web management application. The vulnerability is caused by improper handling of GET inputs included in the URL in “/acng-report.html”...

CVE-2025-11146 Reflected Cross-site scripting (XSS) vulnerability in Apt-Cacher-NG

Reflected Cross-site scripting XSS in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts XSS in the web management application. The vulnerability is caused by improper handling of GET inputs included in the URL in “/acng-report.html”...

CVE-2025-11146

CVE-2025-11146 affects Apt-Cacher-NG (v3.2.1). The vulnerability is a Reflected XSS caused by improper handling of GET inputs in the URL at /acng-report.html, allowing execution of malicious scripts in the web management interface. The available connected documents confirm the affected product/ve...

Unauthorized Disclosure Of Sensitive Data

github.com/rancher/fleet is vulnerable to Unauthorized Disclosure of Sensitive Data. The vulnerability is due to improper access control on BundleDeployment resources with GET or LIST permissions, which allows an attacker to retrieve Helm values containing credentials or other secrets...

Glib-networking: out of bound reads on glib-networking through tls/openssl/gtlscertificate-openssl.c via "g_tls_certificate_openssl_get_property()"

...

CVE-2025-11146: Improper Neutralization of Input During Web Page Generation

Reflected Cross-site scripting XSS in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts XSS in the web management application. The vulnerability is caused by improper handling of GET inputs included in the URL in “/acng-report.html”...

PT-2025-39820

Name of the Vulnerable Software and Affected Versions Apt-Cacher-NG version 3.2.1 Description A reflected cross-site scripting XSS issue exists in the web management application. This allows an attacker to execute malicious scripts. The issue is due to improper handling of GET inputs included in...

Vasion Print Virtual Appliance Host security vulnerability

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 25.1.102 that stems from the filegetcontents function not validating input, which could lead to credential disclosure and...

CVE-2025-41244

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate...