PT-2025-4662 · WordPress · Wp Ulike

Name of the Vulnerable Software and Affected Versions: WP ULike versions prior to 4.7.6 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. This enables attackers to inject malicious scrip...

PT-2025-3258 · Unknown · Poll Maker

Name of the Vulnerable Software and Affected Versions: Poll Maker versions prior to 5.5.6 Description: The issue is related to a missing authorization vulnerability in Poll Maker Team Poll Maker, which allows the exploitation of incorrectly configured access control security levels...

CVE-2024-55920

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

CVE-2024-55893 TYPO3 Cross-Site Request Forgery in Log Module

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

CVE-2024-55921

Summary: CVE-2024-55921 affects TYPO3 via the Extension Manager Module, where a CSRF weakness in deep-link handling and improper acceptance of state-changing actions via HTTP GET can allow an attacker to abuse an active backend session through a malicious URL. Conditions that enable exploitation ...

TYPO3 Cross-Site Request Forgery in Log Module

Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP...

PT-2025-7657

Name of the Vulnerable Software and Affected Versions FFmpeg versions up to 7.1 Description A critical vulnerability was found in FFmpeg, affecting the function ff aac search for tns of the file libavcodec/aacenc tns.c of the component AAC Encoder. The manipulation leads to a stack-based buffer...

PT-2025-7095

Name of the Vulnerable Software and Affected Versions: FFmpeg git master before commit c08d30 Description: A NULL pointer dereference was discovered in the libavformat/mov.c component. Recommendations: For FFMpeg git master before commit c08d30, update to a version that includes the fix for this...

PT-2025-1911 · WordPress · The Ai Scribe

Name of the Vulnerable Software and Affected Versions: The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT GPT-4o 128K plugin for WordPress versions up to, and including, 2.3 Description: The issue is related to unauthorize...

SUSE: Security Advisory (SUSE-SU-2025:0055-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 40 : mingw-poppler (2025-ed039a54de)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-ed039a54de advisory. Backport fix for CVE-2024-56378. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

PT-2025-2412 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: Microweber versions prior to 2.0.9 Description: The issue allows a remote attacker to execute arbitrary code via the campaign Name Internal Name field in the Add new campaign function. This is a Cross Site Scripting vulnerability...

openSUSE Security Advisory (SUSE-SU-2025:0048-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-4712 · Villatheme · Villatheme Advanced Product Information For Woocommerce

Name of the Vulnerable Software and Affected Versions: VillaTheme Advanced Product Information for WooCommerce versions 1.1.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means...

PT-2025-4729 · Unknown · Storepress

Name of the Vulnerable Software and Affected Versions: StorePress versions 1.0.12 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject malicious scripts in...

PT-2025-1608 · WordPress · Postlists

Name of the Vulnerable Software and Affected Versions: PostLists WordPress plugin versions 2.0.2 and earlier Description: The issue is related to the PostLists WordPress plugin, which does not properly escape the $ SERVER'REQUEST URI' parameter before outputting it back in an attribute. This coul...

Mozilla Firefox ESR Security Update (mfsa_2025-03) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

PT-2025-4293 · Unknown · Mzk-Dp300N

Name of the Vulnerable Software and Affected Versions: MZK-DP300N versions 1.05 and earlier Description: A cross-site scripting issue exists, allowing an arbitrary script to be executed on the logged-in user's web browser when accessing a crafted URL, if an attacker logs in to the affected produc...

PT-2025-4440 · Unknown · Nik Chankov Autocompleter

Name of the Vulnerable Software and Affected Versions: Nik Chankov Autocompleter versions 1.3.5.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on ...

PT-2025-4501 · Unknown · Wpmu Prefill Post

Name of the Vulnerable Software and Affected Versions: WPMU Prefill Post versions n/a through 1.02 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially enabling...