SUSE-SU-2025:03018-1 Security update for postgresql15

This update for postgresql15 fixes the following issues: Upgrade to 15.14: - CVE-2025-8713: optimizer statistics can expose sampled data within a view, partition, or child table bsc1248120. - CVE-2025-8714: untrusted data inclusion in pgdump lets superuser of origin server execute arbitrary code ...

CVE-2025-53223

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in undoIT Theme Switcher Reloaded theme-switcher-reloaded allows Reflected XSS.This issue affects Theme Switcher Reloaded: from n/a through = 1.1...

CVE-2025-49407

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1...

CVE-2025-48324

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in khashabawy tli.tl auto Twitter poster tlitl-auto-twitter-poster allows Stored XSS.This issue affects tli.tl auto Twitter poster: from n/a through = 3.4...

CVE-2025-48314

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in salubrio Add Code To Head add-code-to-head allows Stored XSS.This issue affects Add Code To Head: from n/a through = 1.17...

CVE-2025-53220

XmasB Quotes (WordPress) has a reflected XSS in versions up to 1.6.1 due to improper input neutralization during web page generation. Base CVSS 3.1 score 7.1 (HIGH). The remediation is to update to a version later than 1.6.1 (1.6.2+ or patched release). No exploit details or in-the-wild status ar...

CVE-2025-48365

CVE-2025-48365 describes a stored XSS in the WordPress plugin “Custom Comment” (imaprogrammer Custom Comment) affecting versions from n/a through 2.1.6. The root cause is improper input neutralization during web page generation, enabling stored Cross‑Site Scripting. Public sources in the Connecte...

CVE-2025-48352

CVE-2025-48352 describes a stored cross-site scripting (XSS) vulnerability in the WordPress plugin “Яндекс.ПДС Пингер / Yandex Site search pinger” (sitesearch-yandex) up to version 1.5, caused by improper neutralization of input during web page generation. The issue allows stored XSS. Public deta...

CVE-2025-48315

CVE-2025-48315 is a stored XSS vulnerability in the WordPress HTML plugin (versions

postgresql: PostgreSQL executes arbitrary code in restore operation

A flaw was found in PostgreSQL. This vulnerability allows a malicious user of the PostgreSQL server to inject arbitrary code in dump files created by pgdump, pgdumpall, pgrestore, and pgupgrade, causing arbitrary code execution on the client machine or SQL injection when these dump files are...

PT-2025-35012

Name of the Vulnerable Software and Affected Versions: khashabawy tli.tl auto Twitter poster versions through 3.4 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. Recommendations: Update to a...

WordPress plugin Video Gallery – Vimeo and YouTube Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin Tripadvisor Shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-35003

Name of the Vulnerable Software and Affected Versions: salubrio Add Code To Head versions through 1.17 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. Recommendations: Update salubrio Add Co...

PT-2025-35045

Name of the Vulnerable Software and Affected Versions: undoIT Theme Switcher Reloaded versions through 1.1 Description: The software contains a Reflected Cross-Site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update to a version later...

WordPress plugin Golo 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress plugin Captcha.eu 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-58213

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ameliabooking Booking System Trafft booking-system-trafft allows Stored XSS.This issue affects Booking System Trafft: from n/a through = 1.0.14...

CVE-2025-58209

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rtCamp Transcoder transcoder allows Stored XSS.This issue affects Transcoder: from n/a through = 1.4.0...

CVE-2025-58195

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through = 1.4.17...