CVE-2025-49972

CVE-2025-49972 concerns the WordPress plugin TM Replace Howdy (versions

Erlang/OTP 17.0 < 26.2.5.13 / 27.0 < 27.3.4.1 / 28.0 < 28.0.1 Path Traversal (CVE-2025-4748)

The version of Erlang/OTP installed on the remote host is 17.0 prior to 26.2.5.13, 27.0 prior to 27.3.4.1, or 28.0 prior to 28.0.1. It is, therefore, affected by an path traversal vulnerability: - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Erlang...

Google Chrome Security Update (stable-channel-update-for-desktop_17-2025-06) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

CVE-2025-49260

CVE-2025-49260 is a Local File Inclusion vulnerability in the WordPress theme/plugin pair “Aora” from ThemBay, affecting versions up to 1.3.9. The flaw arises from improper control of filenames for include/require statements, enabling PHP Local File Inclusion. Public sources (NVD/Red Hat/Wordfenc...

BIT-GITLAB-2025-4278 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover...

CVE-2025-48916

Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13...

CVE-2025-48914

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15...

CVE-2025-48918 Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Simple Klaro allows Cross-Site Scripting XSS.This issue affects Simple Klaro: from 0.0.0 before 1.10.0...

CVE-2024-9512 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync...

CVE-2025-31398

Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection. This issue affects PIMP - Creative MultiPurpose: from n/a through 1.7...

CVE-2025-48261

Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Data.This issue affects MultiVendorX: from n/a through = 4.2.22...

CVE-2025-48447

CVE-2025-48447 affects Drupal Lightgallery prior to 1.6.0. The issue is described as improper neutralization of input during web page generation, enabling Cross-Site Scripting (XSS). Affected versions are 0.0.0 through 1.6.0, with remediation to update to 1.6.0 or later (per PT-2025-25222). Publi...

CVE-2025-43701

CVE-2025-43701 affects Salesforce OmniStudio (FlexCards). Root cause: improper preservation of permissions allowing exposure of Custom Settings data. Impact: OmniStudio versions before 254. CVSS 3.1 base 7.5 ( HIGH ); attack vector/complexity: network/low, no user interaction required. Remediatio...

CVE-2025-49282

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in unfoldwp Magze magze allows PHP Local File Inclusion.This issue affects Magze: from n/a through = 1.0.9...

CVE-2025-49276

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in unfoldwp Blogmine blogmine allows PHP Local File Inclusion.This issue affects Blogmine: from n/a through = 1.1.7...

CVE-2025-48130

CVE-2025-48130 affects Spice Blocks (WordPress Spice Blocks) with an improper pathname limitation to a restricted directory, enabling path traversal for Spice Blocks versions up to 2.0.7.2. The connected data confirms the vulnerability type and affected versions, but no explicit exploitation stat...

CVE-2025-48281

The CVE describes a SQL Injection vulnerability in the WordPress plugin MyStyle Custom Product Designer (versions up to and including 3.21.1). The issue stems from improper neutralization of user-supplied input and insufficient query preparation, enabling blind SQL injection. Unauthenticated atta...

CVE-2025-49329

Unrestricted Upload of File with Dangerous Type vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Upload a Web Shell to a Web Server.This issue affects Store Locator WordPress: from n/a through = 1.5.2...

CVE-2025-30624

CVE-2025-30624 (WordLift) is a Missing Authorization vulnerability in the WordLift WordLift WordPress plugin. The issue stems from incorrectly configured access control security levels. Affected versions are from n/a through 3.54.4. CVSS v3.1 base score is 4.3 (Medium) with vectors AV:N/AC:L/PR:L...

AZL-64349 CVE-2025-5455 affecting package qtbase for versions less than 6.6.3-4

An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value such as...