Linux Distros Unpatched Vulnerability : CVE-2025-11716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Links in a sandboxed iframe could open an external app on Android without the required allow- permission. This vulnerability was fixed in Firefox 144 and...

WordPress plugin WP Mapbox GL JS Maps 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin ... A cross-site...

CVE-2025-48106

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through 1.3.1...

CVE-2025-11253

CVE-2025-11253 describes an SQL Injection in Netty ERP by Aksis Technology Inc. The issue arises from improper neutralization of special elements in SQL commands, enabling injection in versions prior to V.1.1000 . Multiple sources (NVD/Red Hat/CVE List/CNNVD, PT Security) corroborate the vulnerab...

CVE-2025-12096

CVE-2025-12096 affects the WordPress plugin Simple Excel Pricelist for WooCommerce (versions

CVE-2025-48428

Cleartext Storage of Sensitive Information CWE-312 in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or counterfeit device on that site. This issue...

PT-2025-43604

Name of the Vulnerable Software and Affected Versions Aksis Technology Inc. Netty ERP versions prior to V.1.1000 Description Netty ERP contains a flaw due to improper neutralization of special elements used in an SQL command, leading to a SQL Injection issue. This allows for the potential executi...

PT-2025-43674

Name of the Vulnerable Software and Affected Versions GN4 Publishing System versions prior to 2.6 Description GN4 Publishing System contains an insecure direct object reference IDOR vulnerability via the API. Authenticated requests to the API’s object endpoints allow an authenticated user to...

CVE-2025-62614

BookLore is a self-hosted web app for organizing and managing personal book collections. In versions 1.8.1 and prior, an authentication bypass vulnerability in the BookMediaController allows any unauthenticated user to access and download book covers, thumbnails, and complete PDF/CBX page content...

CVE-2025-54964

An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may inject arbitrary executables. If the Job Service is configured for local-only access, this may allow for privilege escalation in certain situations. If the Job Service is...

EUVD-2025-35647

Uncaught Exception CWE-248 in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 MR2, 9.20 prior to vEL9.20.2819 MR4, 9.10 prior to vEL9.10.3672 MR7, 9.00 prior to...

Proliz Student Affairs Information System 跨站脚本漏洞

Proliz Student Affairs Information System is a student affairs management system from the Turkish company Proliz. A cross-site scripting vulnerability exists in Proliz Student Affairs Information System versions prior to V26.0401, which stems from improper input neutralization during web page...

ArkSigner AcBakImzala 跨站脚本漏洞

ArkSigner AcBakImzala is an electronic signature platform from the Turkish company ArkSigner. A cross-site scripting vulnerability exists in ArkSigner AcBakImzala versions prior to v5.1.4, which stems from improper input neutralization during web page generation and could lead to a reflected...

PT-2025-43554

Name of the Vulnerable Software and Affected Versions BAE SOCET GXP versions prior to 4.6.0.2 Description An issue exists where an attacker interacting with the GXP Job Service can submit a crafted job request to gain read access to files on the filesystem, using the permissions of the GXP Job...

EUVD-2025-35396

Cross-Site Request Forgery CSRF vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Cross Site Request Forgery.This issue affects SUMO Memberships for WooCommerce: from n/a through 7.8.0...

EUVD-2025-35550

Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through 14.8.1...

CVE-2025-49060

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wastia: from n/a through 1.1.3...

CVE-2025-55198 affecting package helm for versions less than 3.14.2-9

CVE-2025-55198 affecting package helm for versions less than 3.14.2-9. A patched version of the package is available...

CVE-2025-0690 affecting package grub2 for versions less than 2.06-15

CVE-2025-0690 affecting package grub2 for versions less than 2.06-15. A patched version of the package is available...

EUVD-2025-35590

MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allows an unauthenticated attacker to log in to the system as any user. This issue has been patched in version 2.10.25-lts...