PT-2025-1996

Name of the Vulnerable Software and Affected Versions WP Finance WordPress plugin versions 1.3.6 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

Security Bulletin: A Security Vulnerability was discovered in IBM Semeru Runtime Certified Edition provided with IBM Security Verify Directory (CVE-2023-33850)

Summary A Security Vulnerability was addressed in IBM Semeru Runtime Certified Edition provided with IBM Security Verify Directory. Vulnerability Details CVEID:CVE-2023-33850 DESCRIPTION: IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side...

PT-2025-4455 · Unknown · Hide Login+

Name of the Vulnerable Software and Affected Versions: Hide Login+ versions 3.5.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For Hide Login+ versions 3.5...

PT-2025-5532 · WordPress · Swit Wp Sessions Time Monitoring Full Automatic

Name of the Vulnerable Software and Affected Versions: SWIT WP Sessions Time Monitoring Full Automatic versions 1.1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This mean...

PT-2025-2179 · Pirateforms · Contact Form & Smtp Plugin

Name of the Vulnerable Software and Affected Versions: The Contact Form & SMTP Plugin for WordPress by PirateForms versions up to, and including, 2.6.0 Description: The issue arises from the software allowing users to execute an action that does not properly validate a value before running do...

PT-2025-1923

Name of the Vulnerable Software and Affected Versions Bulk Me Now! WordPress plugin versions through 2.0 Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

CVE-2024-54461

The file names constructed within fileselector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could...

CVE-2024-54462 Unsanitized Filenames in Flutter package image_picker_android Allow File Overwrites

The file names constructed within imagepicker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could...

CVE-2024-54461 Unsanitized Filenames in Flutter package file_selector_android Allow File Overwrites

The file names constructed within fileselector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could...

PT-2025-1944

Name of the Vulnerable Software and Affected Versions Competition Form WordPress plugin through 2.0 Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be used...

Advisory ROSA-SA-2025-2605

software: libuv 1.44.2 OS: ROSA-CHROME packageevrstring: libuv-1.44.2-2 CVE-ID: CVE-2024-24806 BDU-ID: 2024-02979 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the uvgetaddrinfo function src/unix/getaddrinfo.c, src/win/getaddrinfo.c of the libuv asynchronous I/O library is related to insufficient...

PT-2025-5500 · WordPress · Wp Multi Store Locator

Name of the Vulnerable Software and Affected Versions: WP Multi Store Locator versions 2.4.7 and earlier Description: The issue is related to improper neutralization of script-related HTML tags in a web page, which allows for Reflected XSS attacks. This means that an attacker can inject malicious...

PT-2025-3357 · Baidu · Baidu Input Method

Name of the Vulnerable Software and Affected Versions: Baidu Input Method version 12.6.13 Description: The issue allows attackers to access user information by supplying a crafted link. Recommendations: For version 12.6.13, update to a newer version to mitigate the risk. At the moment, there is n...

PT-2025-1987

Name of the Vulnerable Software and Affected Versions Dyn Business Panel WordPress plugin version 1.0.0 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2025-1695 · WordPress · Broadstreet

Name of the Vulnerable Software and Affected Versions: Broadstreet plugin for WordPress versions up to, and including, 1.50.3 Description: The issue is related to Stored Cross-Site Scripting via the zone parameter due to insufficient input sanitization and output escaping. This allows authenticat...

PT-2025-5135 · Unknown · Notfound Bauernregeln

Name of the Vulnerable Software and Affected Versions: NotFound Bauernregeln versions 1.0.1 and below Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an attacker can...

PT-2025-5462 · WordPress · Orbisius Simple Notice

Name of the Vulnerable Software and Affected Versions: Orbisius Simple Notice versions 1.1.3 and earlier Description: The issue affects the Orbisius Simple Notice plugin, allowing Stored XSS due to improper neutralization of input during web page generation. This can lead to cross-site scripting...

PT-2025-5397 · Unknown · Caching Compatible Cookie Opt-In/Javascript

Name of the Vulnerable Software and Affected Versions: Caching Compatible Cookie Opt-In and JavaScript versions 0.0.0 through 0.0.10 Description: The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows for stored XSS...

Important: python3.12

Issue Overview: Starting in Python 3.12.0, the asyncio.SelectorSocketTransport.writelines method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the...

Medium: runfinch-finch

Issue Overview: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. CVE-2024-45338 golang-jwt is a Go implementation of JSON Web Tokens. Unclear...