CVE-2025-53091

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the /controle/getProdutosPorAlmox.php endpoint. This issue allows any unauthenticated...

SUSE-SU-2025:01455-1 Security update for sqlite3

This update for sqlite3 fixes the following issues: - CVE-2025-3277,CVE-2025-29087: Fixed integer overflow in sqlite concat function bsc1241020 - CVE-2025-29088: Fixed integer overflow through the SQLITEDBCONFIGLOOKASIDE component bsc1241078 Other fixes: - Updated to version 3.49.1 from Factory...

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: Update to version 20250416.02 bsc1244304, bsc1244503 defaultSleeper: tolerate 10% difference to reduce test flakiness Add output of some packagemanagers to the testdata from version 20250416.01 Refactor OS Info package from version...

SUSE-SU-2025:02149-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: - Update to version 20250416.02 bsc1244304, bsc1244503 defaultSleeper: tolerate 10% difference to reduce test flakiness Add output of some packagemanagers to the testdata - from version 20250416.01 Refactor OS Info package - from...

PT-2025-27121 · Unknown · Pebas Couponxxl Custom Post Types

Name of the Vulnerable Software and Affected Versions: pebas CouponXxL Custom Post Types versions 3.0 and earlier Description: The issue is related to an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation in pebas CouponXxL Custom Post Types. Recommendations: For versio...

PT-2025-27226 · Re.Place · Re.Place

Name of the Vulnerable Software and Affected Versions: re.place versions 0.2.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web application, potential...

PT-2025-27134

Name of the Vulnerable Software and Affected Versions: themehunk Zita versions 1.6.5 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion in...

PT-2025-27250 · Unknown · Tabberneue

Name of the Vulnerable Software and Affected Versions: TabberNeue versions 3.0.0 through 3.1.0 Description: The issue allows any user to insert arbitrary HTML into the DOM by inserting a payload into any allowed attribute of the tag, posing a significant security risk to user data. Recommendation...

PT-2025-27107 · Arraytics · Arraytics Eventin

Name of the Vulnerable Software and Affected Versions: Arraytics Eventin versions through 4.0.28 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations: For versions through...

PT-2025-27224 · Unknown · Track Everything

Name of the Vulnerable Software and Affected Versions: Track Everything versions n/a through 2.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-27187 · Unknown · Antoineh Football Pool

Name of the Vulnerable Software and Affected Versions: AntoineH Football Pool versions n/a through 2.12.5 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject...

PT-2025-27203 · Unknown · Rohil Contact Form – 7 : Hide Success Message

Name of the Vulnerable Software and Affected Versions: Rohil Contact Form – 7 : Hide Success Message versions 1.1.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For...

PT-2025-27065 · WordPress · Vr Calendar

Name of the Vulnerable Software and Affected Versions: VR Calendar plugin for WordPress versions prior to 2.4.8 Description: The issue is related to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the syncCalendar function. This makes it possible for...

PT-2025-27206 · Unknown · Gopi Plus Image Slider With Description

Name of the Vulnerable Software and Affected Versions: gopi plus Image Slider With Description versions n/a through 9.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions n/a through 9.2, update to a version that include...

PT-2025-27093 · Unknown · Content No Cache

Name of the Vulnerable Software and Affected Versions: Content No Cache versions 0.1.3 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Code Injection. This vulnerability affects the Content No Cache software...

PT-2025-27103 · Sneeit · Sneeit Magone

Name of the Vulnerable Software and Affected Versions: Sneeit MagOne versions through 8.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inject...

PT-2025-27225 · Unknown · Resume Builder

Name of the Vulnerable Software and Affected Versions: My Resume Builder versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicious...

PT-2025-27197 · Unknown · Smart Agenda

Name of the Vulnerable Software and Affected Versions: Smart Agenda versions n/a through 4.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. Specifically, it is a Stored XSS vulnerability, which means that the...

PT-2025-27207 · Zealousweb · Zealousweb Accept Stripe Payments Using Contact Form 7

Name of the Vulnerable Software and Affected Versions: ZealousWeb Accept Stripe Payments Using Contact Form 7 versions 3.0 and earlier Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For ZealousW...

PT-2025-27062 · WordPress · Buddypress Docs

Name of the Vulnerable Software and Affected Versions: BuddyPress Docs WordPress plugin version 2.2.4 and earlier Description: The issue is related to inadequate access controls in the BuddyPress Docs WordPress plugin, allowing a logged-in user to view and download files belonging to another user...