PT-2025-22110 · Symfony · Symfony/Ux-Live-Component +1

Name of the Vulnerable Software and Affected Versions: symfony/ux-twig-component versions prior to 2.25.1 symfony/ux-live-component versions prior to 2.25.1 Description: The issue concerns the rendering of attributes or the use of methods that return a ComponentAttributes instance, which can lead...

CVE-2024-55063

Multiple Code Injection vulnerabilities in EasyVirt DC NetScope = 8.7.0 allows remote authenticated attackers to execute arbitrary code via the 1 lang parameter to /international/keyboard/options; the 2 keyboardlayout or 3 keyboardvariant parameter to /international/settings/keyboard; the 4...

PT-2025-21964 · Unknown · Back Button Widget

Name of the Vulnerable Software and Affected Versions: Back Button Widget versions 1.6.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can injec...

PT-2025-22088 · WordPress · Themegoods Grand Restaurant

Name of the Vulnerable Software and Affected Versions: ThemeGoods Grand Restaurant WordPress versions n/a through 7.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in ThemeGoods...

ALSA-2025:7893 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: Cross-site Scripting XSS in Grafana via Custom Frontend Plugins and Open Redirect CVE-2025-4123 For more details about the security issues, including the impact, ...

PT-2025-21965 · Woocommerce · Free Shipping Bar: Amount Left For Free Shipping For Woocommerce

Name of the Vulnerable Software and Affected Versions: Free Shipping Bar: Amount Left for Free Shipping for WooCommerce versions through 2.4.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stor...

PT-2025-22061 · Unknown · Binti76 Total Donations

Name of the Vulnerable Software and Affected Versions: binti76 Total Donations versions 3.0.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers ...

PT-2025-21972 · Unknown · Ninjateam Gdpr Ccpa Compliance Support

Name of the Vulnerable Software and Affected Versions: Ninja Team GDPR CCPA Compliance Support versions 2.7.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

WordPress AffiliateImporterEb plugin <= 1.0.6 - Reflected XSS via Search vulnerability

Reflected XSS via Search vulnerability discovered by Bob Matyas in WordPress Plugin AffiliateImporterEb versions = 1.0.6...

MAL-2025-3955 Malicious code in muto-kaiju-npm-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c0ab3464568eaf7276dd21b69d889e2dfa9dcf3b71917dd7f1c9bf08a310de52 The OpenSSF Package Analysis project identified 'muto-kaiju-npm-native' @ 1.0.4 npm as malicious. It is considered malicious because: - The...

PT-2025-21836 · Unknown · Sourcecodester Restaurant Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Restaurant Management System version 1.0 Description: A critical issue affects the processing of the file "/admin/member save.php". The manipulation of the last argument leads to SQL injection. The attack may be initiated remotel...

PT-2025-21827 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 2.1.1-B20230720.1011 Description: A problematic issue has been found in the VPN Page component of the affected software. The manipulation of the Comment argument leads to cross-site scripting. This issue can be exploit...

PT-2025-21848 · Unknown · Sourcecodester Restaurant Management System

Name of the Vulnerable Software and Affected Versions: iSourcecode Restaurant Management System version 1.0 Description: A critical issue was found in the iSourcecode Restaurant Management System, affecting an unknown functionality of the file /admin/user save.php. The manipulation of the...

GHSA-2F4R-34M4-3W8Q Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

Overview Session cookies of applications using the Auth0 Wordpress plugin configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions: 1...

CVE-2025-27525

Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06...

BELL-CVE-2025-4516

Bulletin has no description...

PT-2025-21797 · Ibm · Ibm I +1

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.2 through 7.6 Description: A privilege escalation issue exists in the IBM TCP/IP Connectivity Utilities for i product, allowing a malicious actor with command line access to the host operating system to elevate privileges and...

DLA-4168-1 openafs - security update

Bulletin has no description...

PT-2025-21792 · Ragflow · Ragflow

Name of the Vulnerable Software and Affected Versions: RAGFlow versions 0.18.1 and earlier Description: The issue allows account takeover due to the possibility of conducting successful brute-force attacks against email verification codes. This enables arbitrary account registration, login, and...

PT-2025-21773 · Sourcecodester · Sourcecodester Doctors Appointment System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Doctor's Appointment System version 1.0 Description: A critical vulnerability was found in the Sourcecodester Doctor's Appointment System. This issue affects the unknown code of the file /admin/delete-appointment.php of the...