PT-2025-17782 · Unknown · Felixtz Modern Polls

Name of the Vulnerable Software and Affected Versions: felixtz Modern Polls versions 1.0.10 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For felixtz Modern Polls versions 1.0.10 and earlier, update to a version that...

PT-2025-17710 · WordPress · Lottie Player

Name of the Vulnerable Software and Affected Versions: Lottie Player plugin for WordPress versions up to, and including, 1.1.8 Description: The issue is related to Stored Cross-Site Scripting via File uploads due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2025-17802 · Unknown · Tomontoast Drop Caps

Name of the Vulnerable Software and Affected Versions: tomontoast Drop Caps versions n/a through 2.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-17798 · WordPress · Carlo La Pera Wp Customize Login Page

Name of the Vulnerable Software and Affected Versions: Carlo La Pera WP Customize Login Page versions 1.6.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by Access Control Lists ACLs. This mean...

XWiki 1.8 < 15.10.16, 16.0.0 < 16.4.6, 16.5.0 < 16.10.1 SQLi Vulnerability (GHSA-f69v-xrj8-rhxf)

Xwiki is prone to a SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

PT-2025-17661 · Drupal · Drupal Search Api Solr

Name of the Vulnerable Software and Affected Versions: Drupal Search API Solr versions 0.0.0 through 4.3.8 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed. This issue can be exploited to perform actions on behalf of another...

PT-2025-17511 · Creativemindssolutions · Cm Answers

Name of the Vulnerable Software and Affected Versions: CreativeMindsSolutions CM Answers versions through 3.3.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions through 3.3.3, update to a version that...

PT-2025-17545 · Ibm · Ibm Hardware Management Console

Name of the Vulnerable Software and Affected Versions: IBM Hardware Management Console - Power Systems versions V10.2.1030.0 through V10.3.1050.0 Description: A local privilege escalation issue has been identified, allowing local users to execute commands due to improper validation of libraries...

PT-2025-17077 · Unknown · Simple Email Subscriber

Name of the Vulnerable Software and Affected Versions: Simple Email Subscriber versions n/a through 2.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2025-17145 · Woocommerce · Crowdfunding For Woocommerce

Name of the Vulnerable Software and Affected Versions: Crowdfunding for WooCommerce versions 3.1.12 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an attacker can...

PT-2025-17106 · Woocommerce · Dn Shipping By Weight For Woocommerce

Name of the Vulnerable Software and Affected Versions: DN Shipping by Weight for WooCommerce versions 1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an...

PT-2025-16954 · WordPress · The Forminator Forms

Name of the Vulnerable Software and Affected Versions: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to, and including, 1.42.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and...

PT-2025-17068 · Unknown · Ivan82 User List

Name of the Vulnerable Software and Affected Versions: ivan82 User List versions n/a through 1.5.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected XSS. This is a type of Cross-site Scripting attack where an attacker can...

PT-2025-17120 · Unknown · Turitop Booking System

Name of the Vulnerable Software and Affected Versions: TuriTop Booking System versions 1.0.10 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.0.10 and earlier, update to a version that fixes this...

PT-2025-17154 · Pickplugins · Pickplugins Question Answer

Name of the Vulnerable Software and Affected Versions: PickPlugins Question Answer versions 1.2.70 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.2.70 and earlier, update to a version that fixes th...

PT-2025-16608 · WordPress · Themify Shortcodes

Name of the Vulnerable Software and Affected Versions: Themify Shortcodes versions n/a through 2.1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can injec...

PT-2025-16654 · Unknown · Shahjada Live Forms

Name of the Vulnerable Software and Affected Versions: Shahjada Live Forms versions through 4.8.4 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions through 4.8.4,...

Security Bulletin: Security vulnerabilities have been discovered in IBM Security Verify Bridge (CVE-2024-45673, CVE-2024-45674)

Summary Security vulnerabilities have been addressed in IBM Security Verify Bridge offering. Vulnerability Details CVEID:CVE-2024-45673 DESCRIPTION: IBM Security Verify Bridge stores user credentials in configuration files which can be read by a local user. CWE:CWE-260: Password in Configuration...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v5.0.3 is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v5.0.3 is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability...

PT-2025-16412

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24 Oracle GraalVM for JDK versions 17.0.14, 21.0.6, 24 Oracle GraalVM Enterprise Edition versions 20.3.17, 21.3.13 Description The issue allows an unauthenticated attacker wi...