PT-2025-25208 · Mozilla · Vpn

Name of the Vulnerable Software and Affected Versions: Mozilla VPN versions 2.28.0 and earlier macOS Description: A vulnerability in Mozilla VPN for macOS allows privilege escalation from a normal user to root. This issue only affects Mozilla VPN on macOS, with other operating systems being...

PT-2025-23277 · WordPress · Simple Page Access Restriction

Name of the Vulnerable Software and Affected Versions: The Simple Page Access Restriction plugin for WordPress versions up to, and including, 1.0.31 Description: The issue is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This allows...

Photon OS 4.0: Freetype2 PHSA-2025-4.0-0806

An update of the freetype2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0806. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-46823

The CVE affects the OpenMRS OpenMRS module openmrs-module-fhir2, which provides the FHIR REST API and related services. In versions prior to 2.5.0, privileges were not always correctly checked, enabling unauthorized users to add or edit data they should not access. This vulnerability is described...

PT-2025-22955 · Gibbon · Gibbon

Name of the Vulnerable Software and Affected Versions: Gibbon versions prior to 29.0.00 Description: The issue allows for CSRF attacks. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited...

PT-2025-22972 · Mobatime · Mobatime Amx Mtapi

Name of the Vulnerable Software and Affected Versions: Mobatime AMX MTAPI v6 versions prior to 1.5 Description: The issue concerns Missing Authentication & Authorization in the Web-API of Mobatime AMX MTAPI v6 on IIS, allowing adversaries to gain unrestricted access via the network...

Microsoft VP9 Video Extensions Multiple Vulnerabilities (May 2025) - Windows

Microsoft VP9 Video Extensions is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-22839 · WordPress · Pagelayer

Name of the Vulnerable Software and Affected Versions: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress versions up to, and including, 2.0.0 Description: The issue is related to Reflected Cross-Site Scripting via the login url parameter due to insufficient input...

CVE-2024-47816

ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests. Therefore, if a user on another wiki happens to have the same actor ID as someone on the central wiki, the user on the other wiki can ac...

CVE-2024-23193

E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation...

CVE-2024-25119

TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of $GLOBALS'SYS''encryptionKey' was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes...

CVE-2023-5393

Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code execution. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and...

CVE-2023-45659

Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixe...

CVE-2023-33966

Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and denoruntime 0.114.0, outbound HTTP requests made using the built-in node:http or node:https modules are incorrectly not checked against the network permission allow list --allow-net. Dependencies relying on these built-in modules...

CVE-2022-29943

Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity XXE processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201...

PT-2025-22675 · Unknown · Themeton Hotstar – Multi-Purpose Business Theme

Name of the Vulnerable Software and Affected Versions: HotStar – Multi-Purpose Business Theme versions 1.4 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially lead to security breaches by injecting malicious objec...

PT-2025-22719 · Unknown · Tayori Form

Name of the Vulnerable Software and Affected Versions: Tayori Form versions 1.2.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

PT-2025-22692 · Unknown · Apustheme Butcher

Name of the Vulnerable Software and Affected Versions: ApusTheme Butcher versions n/a through 2.40 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-22740 · Unknown · Likecoin Web3Press

Name of the Vulnerable Software and Affected Versions: LikeCoin Web3Press versions n/a through 3.2.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in LikeCoin Web3Press...

PT-2025-22782 · Verge3D · Verge3D

Name of the Vulnerable Software and Affected Versions: Verge3D versions through 4.9.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an attacker can inject malicious scrip...