Fedora: Security Advisory (FEDORA-2024-0d14d0d2f9)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-22881 · Fess · Fess

Name of the Vulnerable Software and Affected Versions: Fess versions prior to 14.19.2 Description: The issue primarily affects environments where Fess is deployed in a shared or multi-user context, potentially leading to information disclosure. This could allow unauthorized local users to access...

CVE-2024-31411

Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remote code execution RCE. The unrestricted upload is only possible for authenticated and authorized users. This issue affects Apache...

CVE-2023-6179

Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folders. An attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution. Honeywell recommends updating to the most...

CVE-2023-35005

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default only if webserver exposeconfig is set to non-sensitive-only, and not all uncensored values are...

CVE-2022-40955

In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the...

PT-2025-22812 · Schule · Schule

Name of the Vulnerable Software and Affected Versions: Schule versions prior to 1.0.1 Description: The issue concerns a lack of proper rate limiting controls in the file forgot password.php, which is responsible for email-based OTP generation. This allows attackers to abuse the OTP request...

PT-2025-22712 · Goodlayers · Goodlayers Hotel

Name of the Vulnerable Software and Affected Versions: Goodlayers Hotel versions 3.1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inje...

PT-2025-22756 · Mapsvg · Mapsvg

Name of the Vulnerable Software and Affected Versions: MapSVG versions n/a through 8.5.31 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions n/a through 8.5.31, update to ...

PT-2025-22713 · Nasa Core · Nasa Core

Name of the Vulnerable Software and Affected Versions: Nasa Core versions through 6.3.2 Description: The issue affects Nasa Core due to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', allowing PHP Local File Inclusion...

PT-2025-22705 · Boldthemes · Boldthemes Avantage

Name of the Vulnerable Software and Affected Versions: BoldThemes Avantage versions 2.4.6 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 2.4.6 and earlier, update to a version later than 2.4.6 to...

PT-2025-22687 · Unknown · Simple Business Directory Pro

Name of the Vulnerable Software and Affected Versions: Simple Business Directory Pro versions through 15.4.8 Description: The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation in Simple Business Directory Pro. Recommendations: For versions...

PT-2025-22815 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions prior to 9.13.9 Description: The issue concerns the DNN formerly DotNetNuke open-source web content management platform, which is part of the Microsoft ecosystem. In affected versions, uploaded SVG files could...

PT-2025-22759 · Unknown · Facturante

Name of the Vulnerable Software and Affected Versions: Facturante versions n/a through 1.11 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

PT-2025-22791 · Goodlayers · Goodlayers Tourmaster

Name of the Vulnerable Software and Affected Versions: GoodLayers Tourmaster versions through 5.3.8 Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-22677 · Ancorathemes · Ancorathemes Umberto

Name of the Vulnerable Software and Affected Versions: AncoraThemes Umberto versions 1.2.8 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.2.8 and earlier, update to a version that fixes this issue...

PT-2025-22682 · WordPress · Wp Post Modules For Elementor

Name of the Vulnerable Software and Affected Versions: WP Post Modules for Elementor versions n/a through 2.5.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-22650 · Megabip · Megabip

Name of the Vulnerable Software and Affected Versions: MegaBIP versions prior to 5.20 Description: The issue arises from the generation of password reset tokens in MegaBIP software, which uses a small space of random values combined with a queryable value. This allows an unauthenticated attacker...

PT-2025-22799 · Marked · Marked

Name of the Vulnerable Software and Affected Versions: Marked versions prior to 0.3.17 Description: The issue is related to a Regular Expression Denial of Service ReDoS attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacke...

PT-2025-22576 · WordPress · Tournamatch

Name of the Vulnerable Software and Affected Versions: Tournamatch plugin for WordPress versions up to and including 4.6.1 Description: The issue is related to Stored Cross-Site Scripting via the 'trn-ladder-registration-button' shortcode. This is due to insufficient input sanitization and output...