PT-2025-4376 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the "/html/funcionario/dependente listar um.php" endpoint, specifically in the id dependente...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gtk3 (SUSE-SU-2025:0031-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0031-1 advisory. - CVE-2024-6655: Fixed library injection from current working directory bsc1228120. Other fixes: - Update...

Google Chrome Security Update (stable-channel-update-for-desktop-2025-01) - Linux

Google Chrome is prone to a type confusion vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

CVE-2024-52813 matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applicatio...

OPENSUSE-SU-2025:0003-1 Security update for etcd

This update for etcd fixes the following issues: Update to version 3.5.12: Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795 test: fix TestHashKVWhenCompacting: ensure all goroutine finished print error log when creating peer listener failed mvcc: Printing etcd backend database related...

PT-2025-4554 · Unknown · Faaiq Pretty Url

Name of the Vulnerable Software and Affected Versions: Faaiq Pretty Url versions 1.5.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. Recommendations: For versions 1.5.4 and earlier, update to a version that fixes this...

PT-2025-1820 · Unknown · Wpschoolpress

Name of the Vulnerable Software and Affected Versions: School Management System – WPSchoolPress versions up to 2.2.14 Description: The issue is related to SQL Injection via the cid parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

PT-2025-1671 · Progress · Sitefinity

Name of the Vulnerable Software and Affected Versions: Progress Sitefinity versions 4.0 through 14.4.8142 Progress Sitefinity versions 15.0.8200 through 15.0.8229 Progress Sitefinity versions 15.1.8300 through 15.1.8327 Progress Sitefinity versions 15.2.8400 through 15.2.8421 Description: The iss...

PT-2025-3704 · WordPress · Wordpress Auction Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Auction Plugin versions 3.7 and earlier Description: The issue allows editors and above to perform SQL injection attacks due to the plugin not sanitizing and escaping a parameter before using it in a SQL statement. Recommendations:...

CVE-2024-55627

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a specially crafted TCP stream can lead to a very large buffer overflow while being zero-filled during initialization with memset due to an unsigned integer...

CVE-2024-55605

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large input buffer to the tolowercase, touppercase, stripwhitespace, compresswhitespace, dotprefix, headerlowercase, strippseudoheaders, urldecode, or xor...

PT-2025-4479 · Optimizely · Optimizely Configured Commerce

Name of the Vulnerable Software and Affected Versions: Optimizely Configured Commerce versions prior to 5.2.2408 Description: A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that...

PT-2025-1144 · Gocd · Gocd

Name of the Vulnerable Software and Affected Versions: GoCD versions prior to 24.4.0 Description: The issue is related to the incorrect restriction of XML external entity references in GoCD, a continuous delivery server. This can allow "group admins" to abuse the ability to edit raw XML...

phpMyFAQ 3.2.10 < 4.0.2 HTML Injection Vulnerability (GHSA-ww33-jppq-qfrp)

phpMyFAQ is prone to an HTML injection vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"; if...

Mozilla Firefox ESR Security Update (MFSA2024-41) - Mac OS X

Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

CVE-2024-56137 MaxKB RCE vulnerability in function library

MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation RAG. Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerabili...

PT-2025-2506

Name of the Vulnerable Software and Affected Versions: Rara Business versions 1.2.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This can lead to security breaches where an attacker tricks...

PT-2025-2524 · Unknown · The Events Calendar Event Tickets

Name of the Vulnerable Software and Affected Versions: The Events Calendar Event Tickets versions prior to 5.11.0.4 Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue may be exploited to perform actions without the user...

PT-2025-9733

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.1 and 1.23.7 Description A security issue was found in the net/http component. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was...

PT-2025-15633

Name of the Vulnerable Software and Affected Versions: LemonLDAP::NG versions prior to 2.21.0 Description: The issue is related to an XSS problem. The LemonLDAP::NG community has released a new version, 2.21.0, which includes a fix for this issue. Recommendations: For versions prior to 2.21.0,...