DRUPAL-CORE-2025-002

Bulk operations allow authorized users to modify several nodes at once from the Content page /admin/content. A site builder can also add bulk operations to other pages using Views. A bug in the core Actions system allows some users to modify some fields using bulk actions that they do not have...

PT-2025-7384

Name of the Vulnerable Software and Affected Versions PeproDev Ultimate Invoice plugin for WordPress versions up to, and including, 2.0.8 Description The issue concerns an Insecure Direct Object Reference vulnerability in the PeproDev Ultimate Invoice plugin for WordPress. This vulnerability aris...

PT-2025-7782

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The issue concerns permission checks in Feedback activities, where restrictions related to Separate Groups mode were not properly considered before allowing users to view or delete responses...

FortiAnalyzer Log View Read Event Logs

The vulnerability of the Log View component of the FortiAnalyzer security event monitoring and analysis software is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker to read the event logs from another domain...

SUSE CVE-2024-9526

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We...

CVE-2024-13770

The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2.4 via deserialization of untrusted input 'viewmoreposts' AJAX action. This makes it possible for unauthenticated attackers to...

PostgreSQL Vulnerable to Privilege Escalation via Improper Checks in 'pg_stats_ext' and 'pg_stats_ext_exprs' Functions

PostgreSQL is vulnerable to privilege escalation. An attacker could exploit this to access views without correct privileges, potentially gaining access to sensitive data that they shouldn't have access to...

PostgreSQL Vulnerable to Privileged Execution of Arbitrary SQL due to Late Privilege Drop in 'REFRESH MATERIALIZED VIEW CONCURRENTLY'

An authenticated attacker that has created a materialized view could run arbitrary SQL commands on a PostgreSQL server if a victim runs REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's view. If the victim is a superuser this could result in full compromise of the PostgreSQL server...

PT-2025-6609

Name of the Vulnerable Software and Affected Versions The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress versions up to, and including, 4.2.4 Description The issue concerns PHP Object Injection via deserialization of untrusted input in the 'view more posts' AJ...

CVE-2025-1042: Files or Directories Accessible to External Parties

An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way...

CVE-2025-24436

Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to view select information. Exploitation of...

CVE-2025-24532

A vulnerability has been identified in SCALANCE WAB762-1 6GK5762-1AJ00-6AA0 All versions V3.0.0, SCALANCE WAM763-1 6GK5763-1AL00-7DA0 All versions V3.0.0, SCALANCE WAM763-1 ME 6GK5763-1AL00-7DC0 All versions V3.0.0, SCALANCE WAM763-1 US 6GK5763-1AL00-7DB0 All versions V3.0.0, SCALANCE WAM766-1...

CVE-2025-24532

A vulnerability has been identified in SCALANCE WAB762-1 6GK5762-1AJ00-6AA0 All versions V3.0.0, SCALANCE WAM763-1 6GK5763-1AL00-7DA0 All versions V3.0.0, SCALANCE WAM763-1 ME 6GK5763-1AL00-7DC0 All versions V3.0.0, SCALANCE WAM763-1 US 6GK5763-1AL00-7DB0 All versions V3.0.0, SCALANCE WAM766-1...

CVE-2025-24532: Improper Access Control

A vulnerability has been identified in SCALANCE WAB762-1 6GK5762-1AJ00-6AA0 All versions V3.0.0, SCALANCE WAM763-1 6GK5763-1AL00-7DA0 All versions V3.0.0, SCALANCE WAM763-1 ME 6GK5763-1AL00-7DC0 All versions V3.0.0, SCALANCE WAM763-1 US 6GK5763-1AL00-7DB0 All versions V3.0.0, SCALANCE WAM766-1...

PT-2025-6204 · Siemens · Scalance Wam766-1 +4

Name of the Vulnerable Software and Affected Versions: SCALANCE WAB762-1 versions prior to V3.0.0 SCALANCE WAM763-1 versions prior to V3.0.0 SCALANCE WAM763-1 ME versions prior to V3.0.0 SCALANCE WAM763-1 US versions prior to V3.0.0 SCALANCE WAM766-1 versions prior to V3.0.0 SCALANCE WAM766-1 ME...

Siemens SCALANCE Series Access Control Vulnerability

Siemens SCALANCE Series is a family of industrial communication devices from Siemens, Germany. An access control error vulnerability exists in the Siemens SCALANCE Series that arises from an affected device with the user role being affected by incorrect authorization in the SNMPv3 view...

PT-2025-6264 · Fortinet · Fortianalyzer

Name of the Vulnerable Software and Affected Versions: Fortinet FortiAnalyzer versions 6.4.0 through 7.6.0 Description: The issue allows an unauthorized actor to cause information disclosure via filter manipulation, potentially leading to the exposure of sensitive information. This is related to...

Disclosure of Logs of Devices not belonging to the Current ADOM from Log View

...

Quanxun School Affairs System security vulnerabilities

Quanxun School Affairs System is a school affairs system from Quanxun. A security vulnerability exists in Quanxun School Affairs System. An attacker can exploit the vulnerability to view specific pages and obtain database information as well as plaintext administrator credentials...

PT-2025-6146 · Unknown · Quanxun School Affairs System

Name of the Vulnerable Software and Affected Versions: Quanxun School Affairs System affected versions not specified Description: The issue allows unauthenticated attackers to view specific pages and obtain database information as well as plaintext administrator credentials. This exposure of...