Important: php:8.3 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: heap-based buffer overflow in arraymerge CVE-2025-14178 php: PHP: Information disclosure via getimagesize function when reading multi-chunk images CVE-2025-14177 php: PHP: Denial of Service...

SUSE CVE-2025-14180

In PHP versions 8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5. before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTREMULATEPREPARES enabled, an invalid character sequence such as \x99 in a prepared statement parameter may cause the quoting function...

CVE-2025-14180

CVE-2025-14180 affects PHP’s PDO PostgreSQL driver when using PDO::ATTR_EMULATE_PREPARES and can cause a NULL return from PQescapeStringConn on certain invalid parameter sequences, leading to a NULL pointer dereference in pdo_parse_params() and potential server crashes. Connected advisories confi...

cafeorder_vuln_SQL

cafeordervulnSQL Proof-of-Concept and Advisory for Simple Ca...

WordPress Community Events plugin SQL Injection Vulnerability

The WordPress Community Events plugin is a plugin that allows users to publish event information independently through a website form, while administrators can retain the right to final review of calendar content. WordPress Community Events plugin suffers from a SQL injection vulnerability that...

EUVD-2013-3738

Malware in sbrugna...

EUVD-2016-2348

Malware in sbrugna...

EUVD-2023-32120

Malicious code in bioql PyPI...

EUVD-2023-34938

Malicious code in bioql PyPI...

EUVD-2024-54885

Malicious code in bioql PyPI...

EUVD-2025-28242

Malicious code in bioql PyPI...

EUVD-2023-34984

Malicious code in bioql PyPI...

EUVD-2025-31395

Malicious code in bioql PyPI...

EUVD-2023-34935

Malicious code in bioql PyPI...

EUVD-2022-1749

Malicious code in bioql PyPI...

EUVD-2023-34934

Malicious code in bioql PyPI...

EUVD-2023-34939

Malicious code in bioql PyPI...

CVE-2025-59939

WeGIA is a Web manager for charitable institutions. Prior to version 3.5.0, WeGIA is vulnerable to SQL Injection attacks in the control.php endpoint with the following parameters: nomeClasse=ProdutoControle&metodo=excluir&idproduto=malicious command. It is necessary to apply prepared statements...

PT-2025-39699

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.5.0 Description WeGIA, a Web manager for charitable institutions, contains a SQL Injection flaw. The issue affects the control.php endpoint, specifically through the id produto parameter. Exploitation can occur via...

CVE-2025-9172 Vibes <= 2.2.0 - Unauthenticated SQL Injection via `resource` Parameter

The Vibes plugin for WordPress is vulnerable to time-based SQL Injection via the ‘resource’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...