PT-2025-17873 · Backdrop Cms · Flag

Name of the Vulnerable Software and Affected Versions: Backdrop CMS Flag module versions prior to 1.x-3.6.2 Description: A Cross-Site Scripting issue was discovered in the Flag module for Backdrop CMS. The module does not verify flag links before performing the flag action, or verify that the...

PT-2025-17923 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03.1 Description: The issue concerns the exposure of base64-encoded credentials in build logs. Recommendations: For versions prior to 2025.03.1, update to version 2025.03.1 or later to resolve the iss...

Fedora 40 : pgbouncer (2025-31397c2b6c)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-31397c2b6c advisory. Update to 1.24.1, fixes CVE-2025-2291. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Fedora 40 : ImageMagick (2025-9ba0ebe67a)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-9ba0ebe67a advisory. Automatic update for ImageMagick-7.1.1.47-1.fc40. Changelog for ImageMagick Sun Mar 30 2025 Packit - 1:7.1.1.47-1 - Update to version 7.1.1.47 -...

PT-2025-17885 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: The Icegram Express WordPress plugin versions prior to 5.7.50 Description: The issue concerns the Icegram Express WordPress plugin, which does not properly sanitise and escape some of its Template settings. This could allow high-privilege...

PT-2025-17892 · Quantum · Stornext Ryo +2

Name of the Vulnerable Software and Affected Versions: StorNext RYO versions prior to 7.2.4 StorNext Xcellis Workflow Director versions prior to 7.2.4 ActiveScale Cold Storage versions prior to 7.2.4 Description: The issue allows access to internal configuration and unauthorized modification of...

PT-2025-17939 · Netscout · Ngeniusone

Name of the Vulnerable Software and Affected Versions: NETSCOUT nGeniusONE versions prior to 6.4.0 b2350 Description: The issue allows local users to leverage Insecure Permissions for the nGeniusCLI File, potentially leading to unauthorized access or modifications. Recommendations: For versions...

PT-2025-17924 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03.1 Description: The issue is related to improper path validation in the loggingPreset parameter. This could potentially allow for unauthorized access or manipulation of files. Recommendations: For...

PT-2025-17925

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2025.03.1 Description JetBrains TeamCity is affected by a stored Cross-Site Scripting XSS issue on the Data Directory tab. This occurs because the application fails to properly protect the web page structur...

PT-2025-17801 · Unknown · Call Now Pht Blog

Name of the Vulnerable Software and Affected Versions: Call Now PHT Blog versions n/a through 2.4.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web application,...

PT-2025-17710 · WordPress · Lottie Player

Name of the Vulnerable Software and Affected Versions: Lottie Player plugin for WordPress versions up to, and including, 1.1.8 Description: The issue is related to Stored Cross-Site Scripting via File uploads due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2025-17792 · Unknown · Metaloha Dropdown Content

Name of the Vulnerable Software and Affected Versions: metaloha Dropdown Content versions n/a through 1.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in metaloha Dropdown Content...

PT-2025-17786 · WordPress · Wp Custom Post Popup

Name of the Vulnerable Software and Affected Versions: WP Custom Post Popup versions 1.0.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker can...

PT-2025-17787 · Elementor · The Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Pack Elementor addons versions n/a through 2.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in The Pack Elementor addons...

PT-2025-17682 · WordPress · Mang Board Wp

Name of the Vulnerable Software and Affected Versions: Mang Board WP plugin versions up to, and including, 1.8.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the board header and board footer parameters. This allows...

PT-2025-17750 · Vw Themes · Vw Themes Sirat

Name of the Vulnerable Software and Affected Versions: VW Themes Sirat versions prior to 1.5.1 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions prior to 1.5.1,...

PT-2025-17818 · Unknown · Shamim Hasan Custom Functions Plugin

Name of the Vulnerable Software and Affected Versions: Shamim Hasan Custom Functions Plugin versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For Shamim Hasan Custom Functions Plugin versions 1.1 and earlier...

PT-2025-17824 · Unknown · Alphasis Related Posts Via Taxonomies

Name of the Vulnerable Software and Affected Versions: alphasis Related Posts via Taxonomies versions n/a through 1.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a...

Redis DoS Vulnerability (GHSA-r67f-p999-2gff)

Redis is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redis:redis"; if...

PT-2025-17934

Name of the Vulnerable Software and Affected Versions ScreenConnect versions 25.2.3 and earlier Description The issue concerns a ViewState code injection attack in ScreenConnect, which uses ASP.NET Web Forms to preserve page and control state. The data is encoded using Base64 and protected by...