Advisory ROSA-SA-2025-2813

Software: net-snmp 5.8 OS: ROSA Virtualization 3.0 packageevrstring: net-snmp-5.8-30.0.1.rv30 CVE-ID: CVE-2022-24805 BDU-ID: 2024-06509 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the NET-SNMP-VACM-MIB function of the Net-SNMP software suite of the Linux operating system is related to buffer...

WordPress Royal Elementor Addons plugin <= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Marek Mikita Patchstack Alliance in WordPress Plugin Royal Elementor Addons versions = 1.7.1006...

WordPress Advance WP Query Search Filter plugin <= 1.0.10 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Advance WP Query Search Filter versions = 1.0.10...

WordPress Listings for Buildium plugin <= 0.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Abdi Pranata in WordPress Plugin Listings for Buildium versions = 0.1.5...

CVE-2024-52282 Rancher Helm Applications may have sensitive values leaked

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Catalog to read any sensitive information that are contained within the Apps’ values. Additionally, the same information leaks into auditing lo...

CVE-2025-23387 Rancher's SAML-based login via CLI can be denied by unauthenticated users

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9....

CVE-2025-23391 Rancher: Restricted Administrator can change Administrator's passwords

A Incorrect Privilege Assignment vulnerability in SUSE rancher allows a Restricted Administrator to change the password of Administrators and take over their accounts. This issue affects rancher: from 2.8.0 before 2.8.14, from 2.9.0 before 2.9.8, from 2.10.0 before 2.10.4...

BELL-CVE-2025-32728

Bulletin has no description...

Remote Code Execution

@tauri-apps/plugin-shell is vulnerable to Remote Code Execution. The vulnerability is due to insufficient input validation in the /console/dashboard/executorCount?zkClusterKey component, allowing a remote attacker to execute arbitrary code...

PT-2025-16080 · Unknown · Miunosoft Task Scheduler

Name of the Vulnerable Software and Affected Versions: miunosoft Task Scheduler versions 1.6.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables potential attackers to...

PT-2025-16097 · Unknown · G5Theme Ultimate Bootstrap Elements For Elementor

Name of the Vulnerable Software and Affected Versions: g5theme Ultimate Bootstrap Elements for Elementor versions 1.4.9 and earlier Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allo...

PT-2025-16044 · WordPress · Wp Food Ordering/Restaurant Menu

Name of the Vulnerable Software and Affected Versions: WP Food ordering and Restaurant Menu versions 1.1 and earlier Description: The issue is related to an improper control of filename for include/require statement in PHP program, also known as PHP Remote File Inclusion, which allows PHP Local...

PT-2025-16129 · Unknown · Powersystem Center

Name of the Vulnerable Software and Affected Versions: PowerSYSTEM Center affected versions not specified Description: The issue is related to a mishandling of exceptional conditions, where crafted data passed to the API can trigger an exception, resulting in a denial-of-service condition...

CVE-2025-32816

CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity...

WordPress Fazyvo Theme <= 1.6 is vulnerable to Cross Site Scripting (XSS)

Software Fazyvo Type Theme Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31418 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 873abb6ffc87 Credits Mika Required privilege Unauthenticated...

PT-2025-16133 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - Wikibase Media Info Extension versions 1.39 through 1.43 Description: The issue is related to Improper Input Validation, which allows Cross-Site Scripting XSS. This exposes systems to XSS risk. Recommendations: For versions 1.39...

PT-2025-16134 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - AJAX Poll Extension versions 1.39 through 1.43 Description: The issue is related to Improper Input Validation, which allows Cross-Site Scripting XSS in the Mediawiki - AJAX Poll Extension. Recommendations: For versions 1.39 throug...

PT-2025-16070 · Unknown · Easy Post Duplicator

Name of the Vulnerable Software and Affected Versions: Easy Post Duplicator versions 1.0.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-16054 · Scand · Scand Multimailer

Name of the Vulnerable Software and Affected Versions: SCAND MultiMailer versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

SurrealDB has local file read of 2-column TSV files via analyzers

An authenticated system user at the root, namespace, or database levels can use the DEFINE ANALYZER statement to point to arbitrary file locations on the file system, and should the file be tab separated with two columns, the analyzer can be leveraged to exfiltrate the content. This issue was...