Microsoft VP9 Video Extensions RCE Vulnerability (Jun 2025) - Windows

Microsoft VP9 Video Extensions is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-24235 · WordPress · Magazine3 Wp Multilang

Name of the Vulnerable Software and Affected Versions: Magazine3 WP Multilang versions through 2.4.19 Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-24193 · Smartdatasoft · Smartdatasoft Car Repair Services

Name of the Vulnerable Software and Affected Versions: SmartDataSoft Car Repair Services versions n/a through 5.0 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. Recommendations: For versions n/a through 5.0,...

PT-2025-24298 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4847 Description: An allocation of resources without limits or throttling issue has been reported. If a remote attacker gains a user account, they can exploit this issue to prevent other systems,...

PT-2025-24108 · Unknown · 6Storage Rentals

Name of the Vulnerable Software and Affected Versions: 6Storage Rentals versions n/a through 2.19.5 Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions n/a...

Debian: Security Advisory (DLA-4210-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-24294 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4847 Description: An allocation of resources without limits or throttling issue has been reported. If a remote attacker gains a user account, they can exploit this issue to prevent other systems,...

PT-2025-24234 · WordPress · Catchsquare Wp Social Widget

Name of the Vulnerable Software and Affected Versions: catchsquare WP Social Widget versions n/a through 2.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker c...

PT-2025-24301 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4847 Description: A NULL pointer dereference issue allows a remote attacker with a user account to launch a denial-of-service DoS attack. Recommendations: For versions prior to 5.5.6.4847, update to...

PT-2025-24257 · WordPress · Wp Text Expander

Name of the Vulnerable Software and Affected Versions: WP Text Expander versions 1.0.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations:...

PT-2025-24172

Name of the Vulnerable Software and Affected Versions WP Wham All Currencies for WooCommerce versions n/a through 2.4.4 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-24243 · WordPress · Ntc Wp Page Loading

Name of the Vulnerable Software and Affected Versions: NTC WP Page Loading versions 1.0.0 through 1.0.6 Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue affects NTC WP Page Loading, enabling Cross Site Request Forgery...

PT-2025-23945 · Unknown · Bdthemes Element Pack Pro

Name of the Vulnerable Software and Affected Versions: BdThemes Element Pack Pro versions prior to 8.0.0 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions prior t...

PT-2025-23944 · Unknown · Bdthemes Element Pack Pro

Name of the Vulnerable Software and Affected Versions: BdThemes Element Pack Pro versions prior to 8.0.0 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 8.0.0, upda...

PT-2025-23930 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2025.1.10.0 and earlier Description: The issue is related to improper access control in the Tor network blocking feature. This allows an authenticated user to bypass the Tor blocking feature when the Devolutions...

WordPress WP User Frontend Pro plugin <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Foxyyy in WordPress Plugin WP User Frontend Pro versions = 4.1.3...

CVE-2025-5688 Out of Bounds Write in FreeRTOS-Plus-TCP

We have identified a buffer overflow issue allowing out-of-bounds write when processing LLMNR or mDNS queries with very long DNS names. This issue only affects systems using Buffer Allocation Scheme 1 with LLMNR or mDNS enabled. Users should upgrade to the latest version and ensure any forked or...

Exploit for CVE-2025-49113

📧 Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserializat...

Oracle Linux 9 : nodejs:22 (ELSA-2025-8467)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8467 advisory. nodejs 1:22.16.0-1 - Update to 22.16.0 Resolves: RHEL-89600 RHEL-92872 RHEL-92420 Tenable has extracted the preceding description block directly from the Oracle...

PT-2025-23757 · Samsung · Smart Switch Pc

Name of the Vulnerable Software and Affected Versions: Smart Switch versions prior to 3.7.64.10 Description: The issue is related to improper authorization, allowing local attackers to read data with the privilege of Smart Switch on non-Samsung devices. User interaction is required to trigger thi...