CVE-2025-3767 SQL Injection in Centreon BAM boolean KPI listing

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon BAM Boolean KPi Listing modules allows SQL Injection. This page is only accessible to authenticated users with high privileges. This issue affects Centreon BAM: from 24.10 before 24.10.1,...

PT-2025-17528 · Caseproof · Memberpress

Name of the Vulnerable Software and Affected Versions: Memberpress versions 1.11.37 and earlier Description: The issue affects the Memberpress plugin, allowing for Reflected Cross-site Scripting XSS. This occurs due to improper neutralization of input during web page generation. Recommendations:...

PT-2025-17582 · Unknown · Dpmadirektpro

Name of the Vulnerable Software and Affected Versions: DPMAdirektPro version 4.1.5 Description: The issue allows for DLL Hijacking by placing a malicious DLL in a directory, which is then loaded by the application instead of the legitimate DLL. This results in the malicious DLL loading with the...

Security Bulletin: NVIDIA App - April 2025

NVIDIA has released a software update for the NVIDIA App. To protect your system, download and install the latest version of NVIDIA App from the NVIDIA App site. Go to NVIDIA Product Security. Details This section provides a summary of potential vulnerabilities that this security update addresses...

WordPress wProject Theme < 5.8.0 is vulnerable to Privilege Escalation

Software wProject Type Theme Vulnerable versions 5.8.0 Fixed in 5.8.0 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2025-39366 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID dc57f98abe0c Credits Dave Jong Patchstack Required privileg...

PT-2025-17531 · David Gwyer +1 · Simple Sitemap – Create A Responsive Html Sitemap +1

Name of the Vulnerable Software and Affected Versions: Simple Sitemap – Create a Responsive HTML Sitemap versions 3.5.14 and earlier Description: A Missing Authorization issue affects the Simple Sitemap plugin. This issue may allow unauthorized access. Recommendations: For Simple Sitemap – Create...

PT-2025-17493 · Ferranfg · Mpl-Publisher

Name of the Vulnerable Software and Affected Versions: ferranfg MPL-Publisher versions n/a through 2.18.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17517 · Unknown · Ataur R Gutenkit

Name of the Vulnerable Software and Affected Versions: Ataur R GutenKit versions through 2.2.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-17494 · Unknown · Brecht Custom Related Posts

Name of the Vulnerable Software and Affected Versions: Brecht Custom Related Posts versions n/a through 1.7.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

PT-2025-17481 · Zyxel · Zyxel Amg1302-T10B

Name of the Vulnerable Software and Affected Versions: Zyxel AMG1302-T10B version 2.00AAJC.16C0 Description: A path traversal vulnerability in the web management interface could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTT...

PT-2025-17515 · Unknown · Vikrestaurants Table Reservations/Take-Away

Name of the Vulnerable Software and Affected Versions: VikRestaurants Table Reservations and Take-Away versions 1.3.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 1.3.3 and earlier,...

CVE-2024-58250

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges...

PT-2025-17532 · Pluggabl Llc · Booster Plus For Woocommerce

Name of the Vulnerable Software and Affected Versions: Booster Plus for WooCommerce versions through 7.2.4 Description: The issue affects the Booster Plus for WooCommerce plugin, allowing for Reflected XSS due to improper neutralization of input during web page generation. This can lead to...

PT-2025-17511 · Creativemindssolutions · Cm Answers

Name of the Vulnerable Software and Affected Versions: CreativeMindsSolutions CM Answers versions through 3.3.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions through 3.3.3, update to a version that...

PT-2025-17482 · Hitachi · Hitachi Ops Center Analyzer +1

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Common Services versions 10.0.0-00 through 11.0.0-04 Hitachi Ops Center Analyzer viewpoint OVF versions 10.0.0-00 through 11.0.0-04 Description: The issue is related to an authentication credentials leakage. This means that...

PT-2025-17535 · Crocoblock · Jetwoobuilder

Name of the Vulnerable Software and Affected Versions: JetWooBuilder versions 2.1.18 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For JetWooBuilder versions 2.1.18 an...

Cross-Site Scripting

yiisoft/yii is vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is due to in specific scenarios where the fallback error renderer is used, allowing an attacker to execute arbitrary scripts in the context of the user’s browser...

GoBGP crashes in the flowspec parser

An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context...

GoBGP does not verify that the input length

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...

GHSA-C5JG-WR5V-2WP2 GoBGP does not verify that the input length

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...