CVE-2025-59413 CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the forceunsubscribe parameter in the POST request to 1, an attacker can...

CVE-2025-59335 CubeCart Session Not Invalidated After Password Change

CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they accessed their account, an unauthorized use...

PT-2025-38745

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.5.11 Description A flaw exists in the newsletter subscription functionality that permits unauthorized user unsubscription. An attacker can manipulate the force unsubscribe parameter in a POST request to the...

PT-2025-38951

Name of the Vulnerable Software and Affected Versions Awesome Support versions through 6.3.4 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. Recommendations Update Awesome Support to a version later than 6.3.4...

PT-2025-38797

Name of the Vulnerable Software and Affected Versions Ays Pro Photo Gallery by Ays versions through 6.3.6 Description The software contains a flaw related to improper input handling during web page creation, leading to a DOM-Based Cross-site Scripting issue. This allows for the injection of...

PT-2025-39189

Name of the Vulnerable Software and Affected Versions WordPress versions through 6.8.2 Description A flaw exists in WordPress that could allow retrieval of embedded sensitive data through insertion of sensitive information into sent data. The issue is considered low severity and requires...

Inilabs School Express 安全漏洞

Inilabs School Express is a school management software from Inilabs Bangladesh. A security vulnerability exists in Inilabs School Express version 6.2, which stems from insufficient cleanup and coding of the POSTed editor parameter in the content management functionality, which could lead to a...

CVE-2025-36248

IBM Copy Services Manager 6.3.13 is vulnerable to cross-site scripting (CWE-79). The issue allows an unauthenticated user to embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Affected product/version: IBM Copy Services Manager 6.3.13...

UBUNTU-CVE-2025-39852

In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 When tcpaocopyallmatching fails in tcpv6synrecvsock it just exits the function. This ends up causing a memory-leak: unreferenced object 0xffff0000281a8200 size...

BIT-MONGODB-2025-10060 MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0...

Ashlar-Vellum Cobalt Out-of-Bounds Read Vulnerability (CNVD-2025-23023)

Ashlar-Vellum Cobalt is a 3D modeling software developed by Ashlar Vellum, which supports Windows and Mac systems, and is mainly used for 3D modeling and CAD drawing in industrial product design, architectural design and other fields. Ashlar-Vellum Cobalt suffers from an out-of-bounds read...

PT-2025-38496

Name of the Vulnerable Software and Affected Versions PureVPN versions 2.0.1 CLI client and 2.10.0 GUI client Description PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel during network events, such as Wi-Fi reconnects or system resume...

PureVPN 安全漏洞

PureVPN is a VPN software from PureVPN Inc. A security vulnerability exists in the PureVPN CLI version 2.0.1 and GUI version 2.10.0, which stems from IPv6 traffic being leaked after a cyber event, potentially leading to a user privacy breach...

CVE-2025-59691

CVE-2025-59691 affects PureVPN Linux clients (CLI 2.0.1 and GUI 2.10.0). The vulnerability allows IPv6 traffic to leak outside the VPN tunnel during events like Wi‑Fi reconnects or system resume, with the CLI auto-reconnect showing as connected while IPv6 isn’t routed or blocked, and the GUI leav...

CVE-2025-7988 Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target...

CVE-2025-7978 Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability

Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the targ...

WordPress Essential Addons for Elementor plugin <= 6.2.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Thaleikis in WordPress Plugin Essential Addons for Elementor versions = 6.2.4...

CVE-2025-10042 Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection

The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

MongoDB 6.0.x < 6.0.25 / 7.0.x < 7.0.22 / 8.0.x < 8.0.12 (SERVER-95524)

The version of MongoDB installed on the remote host is 6.0 prior to 6.0.25, 7.0 prior to 7.0.22 and 8.0 prior to 8.0.12. It is, therefore, affected by a vulnerability as referenced in the SERVER-95524 advisory. - MongoDB Server may allow upsert operations retried within a transaction to violate...

MongoDB 6.0.x < 6.0.24 / 7.0.x < 7.0.18 / 8.0.x < 8.0.6 (SERVER-100901)

The version of MongoDB installed on the remote host is 6.0 prior to 6.0.24, 7.0 prior to 7.0.18, and 8.0 prior to 8.0.6. It is, therefore, affected by a vulnerability as referenced in the SERVER-100901 advisory. - An improper setting of the lsid field on any sharded query can cause a crash in...