BIT-MODSECURITY2-2025-52891 ModSecurity empty XML tag causes segmentation fault

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least...

PT-2025-27924 · WordPress · Bestwpdeveloper Woocommerce Product Multi-Action

Name of the Vulnerable Software and Affected Versions: BestWpDeveloper WooCommerce Product Multi-Action versions 1.3 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can be exploited in the BestWpDeveloper WooCommerce Product...

PT-2025-27887 · Unknown · Gopiplus Cool Fade Popup

Name of the Vulnerable Software and Affected Versions: gopiplus Cool fade popup versions prior to 10.1 Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as 'SQL Injection', which allows Blind SQL Injection. Recommendations: For...

PT-2025-27854 · WordPress · Smart Docs

Name of the Vulnerable Software and Affected Versions: Smart Docs plugin for WordPress versions up to, and including, 1.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'smartdocs search' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-27880 · Unknown · Cybio Gallery Widget

Name of the Vulnerable Software and Affected Versions: cybio Gallery Widget versions 1.2.1 and earlier Description: The issue is related to the improper neutralization of special elements used in an SQL command, also known as 'SQL Injection'. This allows for SQL Injection in the cybio Gallery...

PT-2025-27864 · Unknown · Whale Browser

Name of the Vulnerable Software and Affected Versions: Whale browser versions prior to 4.32.315.22 Description: The issue allows an attacker to bypass the Same-Origin Policy in a dual-tab environment. This means that an attacker could potentially access or manipulate data from another origin, whi...

PT-2025-27912 · Unknown · Wp Compress

Name of the Vulnerable Software and Affected Versions: WP Compress versions n/a through 6.30.30 Description: A Weak Authentication issue in WP Compress allows for Authentication Abuse. Recommendations: For versions n/a through 6.30.30, update to a version later than 6.30.30 to resolve the issue...

Wireshark 3.6.x < 3.6.14, 4.0.x < 4.0.6 Multiple Vulnerabilities (Jul 2025) - Mac OS X

Wireshark is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"; ifdescripti...

PT-2025-27888 · Unknown · Gopiplus Iframe Images Gallery

Name of the Vulnerable Software and Affected Versions: gopiplus iFrame Images Gallery versions prior to 9.0 Description: The issue is related to the improper neutralization of special elements used in an SQL command, which allows for SQL injection. This is a problem where an attacker can inject...

PT-2025-28026

Name of the Vulnerable Software and Affected Versions: MCP Python SDK versions prior to 1.10.0 Description: The issue arises when a client deliberately triggers an exception after establishing a streamable HTTP session, leading to an uncaught ClosedResourceError on the server side. This can cause...

PT-2025-28017 · Mediawiki · Securepoll Extension +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - SecurePoll extension versions 1.39.0 through 1.39.12 Mediawiki - SecurePoll extension versions 1.42.0 through 1.42.6 Mediawiki - SecurePoll extension versions 1.43.0 through 1.43.1 Description: The issue arises from improper...

PT-2025-27856 · WordPress · Powerfolio

Name of the Vulnerable Software and Affected Versions: PowerFolio plugin for WordPress versions prior to 3.2.1 Description: The issue is related to Stored Cross-Site Scripting via the Custom JS Attributes of the plugin's widgets due to insufficient input sanitization and output escaping. This...

PT-2025-27921 · Unknown · Easy Stripe

Name of the Vulnerable Software and Affected Versions: Easy Stripe versions 1.1 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Remote Code Inclusion. This vulnerability enables remote code inclusion due to a...

PT-2025-27847 · WordPress · Ai Engine

Name of the Vulnerable Software and Affected Versions: AI Engine plugin for WordPress version 2.8.4 Description: The issue is due to an insecure OAuth implementation, specifically the lack of validation for the redirect uri parameter during the authorization flow. This allows unauthenticated...

PT-2025-27840 · WordPress · Wp Shortcodes Plugin

Name of the Vulnerable Software and Affected Versions: WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress versions up to, and including, 7.4.0 Description: The issue is related to Stored Cross-Site Scripting via the data-url DOM element attribute due to insufficient input sanitizatio...

PT-2025-27920 · Unknown · Awplife Neom Blog

Name of the Vulnerable Software and Affected Versions: awplife Neom Blog versions 0.0.0 through 0.0.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For awplife Neom Blo...

PT-2025-27894 · Unknown · Sharable Password Protected Posts

Name of the Vulnerable Software and Affected Versions: Sharable Password Protected Posts version 1.1.1 and earlier Description: The issue allows access to password protected posts by providing a secret key in a GET parameter. However, the key is exposed by the REST API. Recommendations: For...

PT-2025-27866 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.4.0p6 Checkmk versions prior to 2.3.0p35 Checkmk versions prior to 2.2.0p44 Checkmk version 2.1.0 Description: The issue is related to the improper neutralization of Livestatus command delimiters in the autocomplet...

PT-2025-27902 · Webemailprotector · Email Address Security

Name of the Vulnerable Software and Affected Versions: Email Address Security by WebEmailProtector versions n/a through 3.3.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that ...

PT-2025-27937 · WordPress · Kossy - Minimalist Ecommerce Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Kossy - Minimalist eCommerce WordPress Theme versions 1.45 and earlier Description: The issue affects the Kossy - Minimalist eCommerce WordPress Theme due to improper control of filename for include/require statement in PHP program, allowing...