SoftCOM iKSORIS cross-site scripting vulnerability

SoftCOM iKSORIS is an application from SoftCOM, Inc. A cross-site scripting vulnerability exists in SoftCOM iKSORIS versions prior to 79.0, which stems from a reflective cross-site scripting attack that could lead to malicious script execution...

PT-2025-16278 · Autogpt +1 · Autogpt +1

Name of the Vulnerable Software and Affected Versions: AutoGPT versions prior to 0.6.1 Description: The issue allows for the leakage of cross-domain cookies and protected headers in requests redirect. AutoGPT uses a wrapper around the requests python library, which has a fundamental flaw in...

Progress Software WhatsUp Gold authorization issue vulnerability

Progress Software WhatsUp Gold is a network monitoring software from Progress Software, Inc. It is used to monitor the entire network infrastructure as well as applications, configurations and network traffic. An authorization issue vulnerability exists in Progress Software WhatsUp Gold versions...

Apache POI < 5.4.0 Improper Input Validation

The version of Apache POI installed on the remote host is a version prior to 5.4.0. It is, therefore, affected by an improper input validation vulnerability. The issue affects the parsing of OOXML format files like xlsx, docx, and pptx. These file formats are essentially zip files, and it is...

UBUNTU-CVE-2025-32700

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseLog.Php, includes/Pager/AbuseLogPager.Php, includes/Special/SpecialAbuseLog.Php,...

MediaWiki security vulnerabilities

MediaWiki is a suite of free and freely available web-based Wiki engines from the Wikimedia USA Foundation. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki versions prior to 1.39.12, prior to 1.42.6, and prior to...

Moodle 3.11.x < 3.11.14 SQL injection

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.21, 3.11.x prior to 3.11.14, 4.0.x prior to 4.0.8 or 4.1.x prior to 4.1.3. It is, therefore, affected by a limited SQL injection in functionality used by the Wiki activity when listing pages. Note...

Moodle 4.2.x < 4.2.4 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.25 / 3.11.x prior to 3.11.18 / 4.0.x prior to 4.0.12 / 4.1.x prior to 4.1.7 / 4.2.x prior to 4.2.4. It is, therefore, affected by multiple vulnerabilities: - XSS risk when manually running a task ...

Dell PowerScale OneFS security vulnerabilities

PowerScale OneFS is a distributed storage operating system developed by Dell to provide unified file system management and high availability services for enterprise-class storage environments. Dell PowerScale OneFS suffers from an authorization logic error vulnerability that stems from not proper...

Moodle 4.0.x < 4.0.8 SQL injection

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.21, 3.11.x prior to 3.11.14, 4.0.x prior to 4.0.8 or 4.1.x prior to 4.1.3. It is, therefore, affected by a limited SQL injection in functionality used by the Wiki activity when listing pages. Note...

Moodle 4.0.x < 4.0.9 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.22, 3.11.x prior to 3.11.15, 4.0.x prior to 4.0.9 or 4.1.x prior to 4.1.4. It is, therefore, affected by multiple vulnerabilities. - An issue in the logic used to check 0.0.0.0 against the cURL...

Drupal security vulnerabilities

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal versions prior to 4.9.0 that stems from a lack of authentication for critical functions, which could lead to improper access control...

Schneider Electric Trio Q Licensed Data Radio security vulnerability

Schneider Electric Trio Q Licensed Data Radio is a radio from Schneider Electric France. A security vulnerability exists in Schneider Electric Trio Q Licensed Data Radio versions prior to v2.7.2, which stems from insecure storage of sensitive information and could lead to unauthorized access...

Shopware security vulnerability

Shopware is a suite of open source e-commerce software from the German company Shopware. A security vulnerability exists in Shopware versions prior to 6.6.10.3 and prior to 6.5.8.17, which stems from a default setting that allows unconfirmed bulk news subscriptions...

BentoML code-related vulnerabilities

BentoML is an open source modeling service library from BentoML Open Source. It is used to build high-performance and scalable artificial intelligence applications using Python. A code issue vulnerability exists in BentoML versions prior to 1.4.8 that stems from insecure deserialization and could...

CVE-2025-1095

IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation LPE. The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a l...

CVE-2025-22461

SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution...

CVE-2025-22458

DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System...

PT-2025-15431 · Fortinet · Fortiisolator Cli

Name of the Vulnerable Software and Affected Versions: Fortinet FortiIsolator CLI versions prior to 2.4.6 Description: The issue is related to an improper neutralization of special elements used in an OS command, which allows a privileged attacker to execute unauthorized code or commands via...

PT-2025-15599 · Unknown · Broadstreet

Name of the Vulnerable Software and Affected Versions: Broadstreet versions n/a through 1.51.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions n/...