RHSA-2025:8607 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

PT-2025-24114 · Unknown · Cmsminds Pay With Contact Form 7

Name of the Vulnerable Software and Affected Versions: cmsMinds Pay with Contact Form 7 versions 1.0.0 through 1.0.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack...

PT-2025-24178 · Buddydev · Buddydev Activity Plus Reloaded

Name of the Vulnerable Software and Affected Versions: BuddyDev Activity Plus Reloaded for BuddyPress versions 1.1.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels...

PT-2025-24085

Name of the Vulnerable Software and Affected Versions ThemeGoods Photography versions prior to 7.5.3 Description The issue is related to Deserialization of Untrusted Data. This affects ThemeGoods Photography, allowing potential exploitation. Recommendations For versions prior to 7.5.3, update to...

PT-2025-24003 · Unknown · Soluçõescoop Isoluçõesweb

Name of the Vulnerable Software and Affected Versions: SoluçõesCoop iSoluçõesWEB versions prior to 20250519 Description: A problem was found in some unknown functionality of the file /fluxos-dashboard of the component Flow Handler. The manipulation of the Descrição da solicitação argument leads t...

PT-2025-24225 · Unknown · Calculated Fields Form

Name of the Vulnerable Software and Affected Versions: Calculated Fields Form versions 5.3.58 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Calculated Fields Form, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 5.3.5...

PT-2025-24201 · Unknown · Everest Backup

Name of the Vulnerable Software and Affected Versions: Everest Backup versions n/a through 2.3.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions n/a through 2.3.3, update to a version later than 2.3....

PT-2025-24187 · Unknown · Elite Video Player

Name of the Vulnerable Software and Affected Versions: Elite Video Player versions 10.0.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Elite Video Player, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For Elite Video Player...

PT-2025-24170 · Unknown · Michael Cannon Custom Bulk/Quick Edit

Name of the Vulnerable Software and Affected Versions: Michael Cannon Custom Bulk/Quick Edit versions 1.6.10 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by...

PT-2025-24240 · Unknown · Ovatheme Brw

Name of the Vulnerable Software and Affected Versions: ovatheme BRW versions 1.8.6 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-24094 · Unknown · The Plus Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder Lite versions through 6.2.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

PT-2025-24266 · Unknown · Bacon Ipsum

Name of the Vulnerable Software and Affected Versions: Bacon Ipsum versions n/a through 2.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicio...

PT-2025-24054 · Apache · Apache

Name of the Vulnerable Software and Affected Versions: Apache versions prior to the fixed version Description: A missing protection against path traversal allows access to any file on the server. This issue affects the Apache software, allowing unauthorized access to files. Recommendations: For...

PT-2025-24261 · WordPress · Hasina77 Wp Easy Allopass

Name of the Vulnerable Software and Affected Versions: Hasina77 Wp Easy Allopass versions n/a through 4.1.1 Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue affects the specified versions of Hasina77 Wp Easy Allopass,...

PT-2025-24250 · Gamipress · Gamipress

Name of the Vulnerable Software and Affected Versions: GamiPress versions n/a through 7.4.5 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

PT-2025-24072 · Quickcab · Quickcab

Name of the Vulnerable Software and Affected Versions: QuickCab versions 1.3.3 and earlier Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access to certain features or...

PT-2025-24237 · Unknown · Ht Team Member

Name of the Vulnerable Software and Affected Versions: HT Team Member versions 1.1.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-24299 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4847 Description: A NULL pointer dereference issue allows a remote attacker with a user account to launch a denial-of-service DoS attack. Recommendations: For versions prior to 5.5.6.4847, update to...

PT-2025-24158 · Unknown · Acf: Yandex Maps Field

Name of the Vulnerable Software and Affected Versions: ACF: Yandex Maps Field versions 1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in ACF: Yandex Maps Field...

PT-2025-24198 · Unknown · Rtmkit Addons For Elementor

Name of the Vulnerable Software and Affected Versions: RTMKit Addons for Elementor versions 1.6.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...