sudo-1.9.17p1-1.1 on GA media (moderate)

sudo-1.9.17p1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15298-1 Rating: moderate Cross-References: CVE-2025-32462 CVE-2025-32463 CVSS scores: CVE-2025-32462 SUSE : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2025-32462 SUSE : 7.3...

PT-2025-27873 · WordPress · Wp Fancybox

Name of the Vulnerable Software and Affected Versions: Noor Alam WP fancybox versions 1.0.0 through 1.0.4 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This enables attackers to inject malicious...

PT-2025-28018 · Mediawiki · Mediawiki Securepoll Extension

Name of the Vulnerable Software and Affected Versions: MediaWiki SecurePoll extension versions 1.39.X through 1.39.12 MediaWiki SecurePoll extension versions 1.42.X through 1.42.6 MediaWiki SecurePoll extension versions 1.43.X through 1.43.1 Description: The issue arises from the lack of validati...

PT-2025-29189 · Tenda · Tenda O3V2

Name of the Vulnerable Software and Affected Versions: Tenda O3V2 version 1.0.0.123880 Description: A critical issue exists in Tenda O3V2. The formWifiBasicSet function within the /goform/setWrlBasicInfo file of the httpd component is susceptible to a stack-based buffer overflow. This occurs...

PT-2025-27885 · Unknown · Amazewp Fluxtore

Name of the Vulnerable Software and Affected Versions: amazewp fluXtore versions 1.6.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: For amazewp...

PT-2025-27941 · Unknown · Thanhtungtnt Video List Manager

Name of the Vulnerable Software and Affected Versions: thanhtungtnt Video List Manager versions 1.7 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows attackers to execute malicious...

PT-2025-27928 · Inspirythemes · Realhome

Name of the Vulnerable Software and Affected Versions: Inspirythemes RealHomes versions through 4.4.0 Description: The issue is related to an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation in InspiryThemes RealHomes. Recommendations: For versions through 4.4.0, upda...

PT-2025-28022 · Zipkin +1 · Zipkin +1

Name of the Vulnerable Software and Affected Versions: Zipkin versions prior to 3.5.2 Description: The issue is related to the exposure of heap dump information through the "/heapdump" endpoint, which is associated with the use of Spring Boot Actuator. This endpoint is similar to a previously...

PT-2025-27905 · Click & Pledge · Click & Pledge Connect

Name of the Vulnerable Software and Affected Versions: Click & Pledge Connect versions 25.04010101 through WP6.8 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for privilege escalation...

PT-2025-27879 · Unknown · Contact Us Page – Contact People

Name of the Vulnerable Software and Affected Versions: Contact Us page - Contact people LITE versions 3.7.4 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection,...

PT-2025-27881 · Cwd · Cwd Web Designer Easy Elements Hider

Name of the Vulnerable Software and Affected Versions: CWD Web Designer Easy Elements Hider versions 2.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can...

Fixed in Apache Tomcat 9.0.107

Important: APR/Native Connector crash leading to DoS CVE-2025-52434 A race condition on connection close could trigger a JVM crash when using the APR/Native connector leading to a DoS. This was particularly noticeable with client initiated closes of HTTP/2 connections. This was fixed with commit...

PT-2025-28015 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - IPInfo Extension versions 1.39.X through 1.39.12 Mediawiki - IPInfo Extension versions 1.42.X through 1.42.6 Mediawiki - IPInfo Extension versions 1.43.X through 1.43.1 Description: The issue affects the Mediawiki - IPInfo...

PT-2025-27871 · Long Watch Studio · Myrewards

Name of the Vulnerable Software and Affected Versions: Long Watch Studio MyRewards versions n/d through 5.4.13.1 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. Recommendations: For...

PT-2025-27863 · Unknown · Whale Browser

Name of the Vulnerable Software and Affected Versions: Whale browser for iOS versions prior to 3.9.1.4206 Description: The issue allows an attacker to execute malicious scripts in the browser via a crafted JavaScript scheme. This can be achieved by manipulating a specific JavaScript scheme...

PT-2025-29171 · Tenda · Tenda O3V2

Name of the Vulnerable Software and Affected Versions: Tenda O3V2 version 1.0.0.123880 Description: A critical issue exists in the Tenda O3V2 router. The fromSysToolTime function within the /goform/setSysTimeInfo file of the httpd component is affected by a stack-based buffer overflow. Manipulati...

PT-2025-28014 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - IPInfo Extension versions 1.39.X through 1.39.12 Mediawiki - IPInfo Extension versions 1.42.X through 1.42.6 Mediawiki - IPInfo Extension versions 1.43.X through 1.43.1 Description: The issue is related to Uncontrolled Resource...

PT-2025-27942 · Unknown · Wpo-Hr Ngg Smart Image Search

Name of the Vulnerable Software and Affected Versions: wpo-HR NGG Smart Image Search versions 3.4.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-27940 · Unknown · Bsecure - Your Universal Checkout

Name of the Vulnerable Software and Affected Versions: bSecure - Your Universal Checkout versions 1.7.9 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, which affects the bSecure - Your Universal Checkout software. This...

PT-2025-27893 · Woocommerce · Trust Payments Gateway For Woocommerce

Name of the Vulnerable Software and Affected Versions: Trust Payments Gateway for WooCommerce JavaScript Library versions 1.3.6 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows unauthorized actions to be performed on behalf of a user. This c...