PT-2025-21546 · WordPress · Cyan Backup

Name of the Vulnerable Software and Affected Versions: CYAN Backup WordPress plugin versions prior to 2.5.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, fo...

PT-2025-21393 · WordPress · Happyforms

Name of the Vulnerable Software and Affected Versions: Happyforms versions prior to 1.26.3 Description: The issue concerns the Happyforms plugin for WordPress, where certain settings are not properly sanitized and escaped. This could allow high-privilege users, such as administrators, to perform...

PT-2025-21397 · WordPress · Giveaways/Contests By Rafflepress

Name of the Vulnerable Software and Affected Versions: Giveaways and Contests by RafflePress WordPress plugin versions prior to 1.12.17 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html...

PT-2025-21550

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager versions prior to 2.2.2 Description: The issue allows a logged-in admin to download system files outside of the WordPress directory. This is a significant concern as it could potentially expose sensitive system...

PT-2025-21535 · WordPress · Nested Pages

Name of the Vulnerable Software and Affected Versions: Nested Pages WordPress plugin versions prior to 3.2.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and...

PT-2025-21468 · WordPress · The Ultimate Noindex Nofollow Tool Ii

Name of the Vulnerable Software and Affected Versions: The Ultimate Noindex Nofollow Tool II WordPress plugin versions prior to 1.3.6 Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to...

PT-2025-21270 · Hitachi · Hitachi Jp1/It Desktop Management 2 - Smart Device Manager

Name of the Vulnerable Software and Affected Versions: Hitachi JP1/IT Desktop Management 2 - Smart Device Manager versions 10-50 through 10-50-06 Hitachi JP1/IT Desktop Management 2 - Smart Device Manager versions 11-00 through 11-00-05 Hitachi JP1/IT Desktop Management 2 - Smart Device Manager...

PT-2025-21522 · WordPress · The Events Calendar

Name of the Vulnerable Software and Affected Versions: The Events Calendar WordPress plugin versions prior to 6.6.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised...

Photon OS 5.0: Redis PHSA-2025-5.0-0522

An update of the redis package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0522. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Eclipse Jetty Information Disclosure Vulnerability (GHSA-q4rv-gq96-w7c5) - Windows

Eclipse Jetty is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty"...

Alibaba Cloud Linux 3 : 0163: subversion:1.14 (ALINUX3-SA-2022:0163)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0163 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-24070: Subversion's moddavsvn is vulnerabl...

Alibaba Cloud Linux 3 : 0172: bubblewrap and flatpak (ALINUX3-SA-2024:0172)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0172 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-42472: Flatpak is a Linux application...

PT-2025-21228 · Kingsoft · Wps Office

Name of the Vulnerable Software and Affected Versions: WPS Office versions prior to 19302 Description: The issue allows a local attacker to obtain sensitive information via a crafted file. Recommendations: For versions prior to 19302, update to version 19302 or later to resolve the issue...

PT-2025-21191 · Unknown · Cookies Consent Management

Name of the Vulnerable Software and Affected Versions: COOKiES Consent Management versions 0.0.0 through 1.2.13 Description: The issue affects the COOKiES Consent Management module, allowing for Cross-Site Scripting XSS due to improper neutralization of input during web page generation...

KLA83650 SB vulnerabilities in Google Chrome

Security vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to bypass security restrictions. Original advisories Stable Channel Update for Desktop Exploitation Public exploits exist for this vulnerability. CVE list CVE-2025-4664 warning CVE-2025-4609...

Alibaba Cloud Linux 3 : 0006: parfait:0.5 (ALINUX3-SA-2022:0006)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0006 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2021-4104: JMSAppender in Log4j 1.2 is...

PT-2025-21134 · WordPress · Uncanny Automator

Name of the Vulnerable Software and Affected Versions: Uncanny Automator plugin for WordPress versions up to, and including, 6.4.0.2 Description: The issue is related to a missing capability check on multiple AJAX functions, allowing authenticated attackers with subscriber-level permissions or...

PT-2025-21161 · Netgate · Pfsense Ce

Name of the Vulnerable Software and Affected Versions: Netgate pfSense CE versions prior to 2.8.0 beta release Netgate pfSense CE corresponding Plus builds versions prior to 2.8.0 beta release Description: The issue is related to Cross Site Scripting XSS in the widgets/log.widget.php file. This...

Ubuntu: Security Advisory (USN-7508-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Remote Desktop Client Multiple Vulnerabilities (Apr 2025) - Windows

Remote Desktop Client is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...