WordPress plugin PGS Core SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injectio...

PT-2025-39565

Name of the Vulnerable Software and Affected Versions Potenzaglobalsolutions PGS Core versions through 5.9.0 Description A flaw exists in Potenzaglobalsolutions PGS Core that allows SQL Injection due to improper neutralization of special elements used in an SQL command. This could allow an attack...

PT-2025-39689

Name of the Vulnerable Software and Affected Versions WAYOS versions 22.03.17 LQ 04, LQ 05, LQ 06, LQ 07, and LQ 09 Description A flaw exists in WAYOS that allows for command injection. This occurs due to the manipulation of the Name argument within an unknown function of the /usb paswd.asp file...

WordPress Banhammer plugin <= 3.4.8 - Unauthenticated Protection Mechanism Bypass vulnerability

Unauthenticated Protection Mechanism Bypass vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Banhammer versions = 3.4.8...

CVE-2025-26482

Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2025-11005 TOTOLINK X6000R Unauthenticated Command Injection Vulnerability

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458B20250708...

CVE-2025-11005

The CVE-2025-11005 issue affects TOTOLINK X6000R, where OS Command Injection arises from improper neutralization of special elements in user input. Affected versions: X6000R up to and including V9.4.0cu.1458_B20250708. Root cause: failure to properly filter special elements allows an attacker to ...

CVE-2025-20311

A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent attacker to cause an egress port to become blocked and drop all outbound traffic. This vulnerability is due to improper handling of crafte...

AlmaLinux 9 : kernel (ALSA-2025:15740)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:15740 advisory. kernel: ipv6: mcast: Delay put pmc-idev in mlddeldelrec CVE-2025-38550 Tenable has extracted the preceding description block directly from the AlmaLinux security...

CVE-2025-59828

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...

CVE-2025-57942

Cross-Site Request Forgery CSRF vulnerability in andymoyle Emergency Password Reset emergency-password-reset allows Cross Site Request Forgery.This issue affects Emergency Password Reset: from n/a through = 9.3...

CVE-2025-58690

Cross-Site Request Forgery CSRF vulnerability in ptibogxiv Doliconnect doliconnect allows Stored XSS.This issue affects Doliconnect: from n/a through = 9.5.7...

CVE-2025-20316

CVE-2025-20316 describes a vulnerability in the ACL programming of Cisco IOS XE Software on Cisco Catalyst 9500X and 9600X Series Switches. The issue allows an unauthenticated, remote attacker to bypass a configured egress ACL. The root cause is tied to traffic flooding from an unlearned MAC addr...

CVE-2025-20311

CVE-2025-20311 affects Cisco IOS XE Software for Catalyst 9000 Series Switches. The root cause is improper handling of crafted Ethernet frames, enabling an unauthenticated adjacent attacker to cause an egress port to block and drop all outbound traffic, resulting in DoS. The advisory notes that a...

CVE-2025-8869

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python versi...

CVE-2025-9353

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

PT-2025-39313

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R versions through V9.4.0cu.1360 B20241207 Description The software contains an improper input validation issue that can lead to command injection and file manipulation. The vulnerability exists due to insufficient validation of...

Oracle Linux 9 : kernel (ELSA-2025-16398)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-16398 advisory. - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skbpull CKI Backport Bot RHEL-112246 CVE-2023-53125 - net: usb: smsc75xx:...

RHEL 9 : cups (RHSA-2025:16592)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:16592 advisory. The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: cup...

Important: Red Hat Security Advisory: podman security update

An update for podman is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...