SUSE-SU-2025:1332-1 Security update for rekor

This update for rekor fixes the following issues: - CVE-2023-45288: rekor: golang.org/x/net/http2: Fixed close connections when receiving too many headers bsc1236519 - CVE-2024-6104: rekor: hashicorp/go-retryablehttp: Fixed sensitive information disclosure inside log file bsc1227053 -...

PT-2025-17056 · Unknown · Antoine Guillien Restrict Taxonomies

Name of the Vulnerable Software and Affected Versions: Antoine Guillien Restrict Taxonomies versions 1.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potenti...

PT-2025-17087 · Event Espresso · Event Espresso – Custom Email Template Shortcode

Name of the Vulnerable Software and Affected Versions: Event Espresso – Custom Email Template Shortcode versions 1.0.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in...

CVE-2025-3733

CVE-2025-3733 covers a Cross-Site Scripting (XSS) vulnerability in the Drupal baguetteBox.Js integration. The issue stems from improper input neutralization in baguetteBox.Js when used in Drupal. Affected versions are baguetteBox.Js 0.0.0 through 2.0.3 and 3.0.0 through 3.0.0. Remediation, where ...

WordPress Live Forms plugin <= 4.8.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Live Forms versions = 4.8.4...

CVE-2025-39578

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Stored XSS.This issue affects Responsive Blocks: from n/a through = 2.0.2...

CVE-2025-27009

Cross-Site Request Forgery CSRF vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through = 3.6.33...

SUSE-SU-2025:1285-1 Security update for etcd

This update for etcd fixes the following issues: - Update to version 3.5.21: - CVE-2025-30204: Fixed a bug that could allow excessive memory allocation during header parsing in jwt-go. bsc1240515...

CVE-2024-13177 Symlink Following in Netskope Client Postinstall Script

Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A standard user could potentially create a symlink of the file “nsinstallation” to escalate the privileges of a different file on the system...

CVE-2025-3622

A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference/thirdparty/cosyvoice/cli/model.py. The manipulation leads to deserialization...

CVE-2025-31344

Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2...

PT-2025-16217 · Veal98 · Veal98

Name of the Vulnerable Software and Affected Versions: veal98 小牛肉 Echo 开源社区系统 version 4.2 Description: A critical issue has been found in the function uploadMdPic of the file /discuss/uploadMdPic. The manipulation of the argument editormd-image-file leads to unrestricted upload. The attack may be...

OpenPanel 0.3.4 - Directory Traversal

Exploit Title: OpenPanel 0.3.4 - Directory Traversal Date: Dec 05, 2024 Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee Vendor Homepage: https://openpanel.com/ Software Link: https://openpanel.com/ Version: 0.3.4 Tested on: macOS CVE : CVE-2024-53537 Compress Function POS...

OpenPanel 0.3.4 - Incorrect Access Control

Exploit Title: OpenPanel 0.3.4 - Incorrect Access Control Date: Nov 25, 2024 Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee Vendor Homepage: https://openpanel.com/ Software Link: https://openpanel.com/ Version: 0.3.4 Tested on: macOS CVE : CVE-2024-53582 GET /files/../...

CVE-2025-32551

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace connector-civicrm-mcrestface allows Reflected XSS.This issue affects Connector to CiviCRM with CiviMcRestFace: from n/a through = 1.0.8...

CVE-2025-32567

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in dev02ali Easy Post Duplicator easy-post-duplicator allows SQL Injection.This issue affects Easy Post Duplicator: from n/a through = 1.0.1...

CVE-2025-31565

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Lisandro Martinez WPSmartContracts wp-smart-contracts allows Blind SQL Injection.This issue affects WPSmartContracts: from n/a through = 2.0.12...

CVE-2025-32128

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in aaronfrey Nearby Locations nearby-locations allows SQL Injection.This issue affects Nearby Locations: from n/a through = 1.1.1...

PT-2025-17571 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5232 B20210713 Description: The issue is a pre-auth remote command execution vulnerability in the setWebWlanIdx function through the webWlanIdx parameter. This allows for remote command execution without prior...

Advisory ROSA-SA-2025-2845

Software: harfbuzz 1.7.5 OS: ROSA Virtualization 2.1 packageevrstring: harfbuzz-1.7.5-4.rv3 CVE-ID: CVE-2023-25193 BDU-ID: 2023-06149 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the hb-ot-layout-gsubgpos.hh component of the Harfbuzz text conversion library is associated with unrestricted resourc...