Microsoft Edge (Chromium-Based) Multiple Vulnerabilities (Jan 2025)

Microsoft Edge Chromium-Based is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-2170 · WordPress · Webcamconsult

Name of the Vulnerable Software and Affected Versions: Webcamconsult plugin for WordPress versions up to, and including, 1.5.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This allows unauthenticated attackers to updat...

PT-2025-3938 · Unknown · Codezips Gym Management System

Name of the Vulnerable Software and Affected Versions: Codezips Gym Management System version 1.0 Description: A critical issue has been found in the system, allowing for remote SQL injection attacks. The manipulation of the m id argument in the file /dashboard/admin/new submit.php leads to this...

Mozilla Thunderbird Security Update (mfsa_2025-04) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

PT-2025-4915 · WordPress · Wordpress Logging Service

Name of the Vulnerable Software and Affected Versions: WordPress Logging Service versions 1.5.4 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a...

Microsoft Outlook 2016 RCE Vulnerability (KB5002656)

This host is missing an important security update according to Microsoft KB5002656 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Gradio Blocked Path ACL Bypass Vulnerability

Summary Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windo...

PT-2025-3489 · Monetdb · Monetdb Server

Name of the Vulnerable Software and Affected Versions: MonetDB Server version 11.49.1 Description: The issue in the exp bin component of MonetDB Server allows attackers to cause a Denial of Service DoS via crafted SQL statements. Recommendations: For MonetDB Server version 11.49.1, consider...

Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2025-1054)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-2893 · Gestioip · Gestioip

Name of the Vulnerable Software and Affected Versions: GestioIP version 3.5.7 Description: The issue concerns a Stored XSS vulnerability in the ip mod dns key form.cgi request. An attacker can inject malicious code into the TSIG Key field, which is saved in the database and triggers XSS when...

CVE-2025-23109

CVE-2025-23109 affects Firefox for iOS prior to version 134. The issue arises from long hostnames in URLs that can be used to obscure the actual host or spoof the website address. Mozilla’s advisory MFSA2025-06 confirms fixes shipped with Firefox iOS 134, and related entries note client-side path...

Important: jackson-databind

Issue Overview: In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization...

PT-2025-1232 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version 9.1.0cu.2350 B20230313 Description: The issue is related to an OS command injection vulnerability. This vulnerability can be exploited via the limit parameter in the setVpnAccountCfg function. The vulnerability allows ...

CVE-2024-56290

CVE-2024-56290 affects the WordPress plugin Multiple Shipping And Billing Address For Woocommerce (slug: different-shipping-and-billing-address-for-woocommerce) and is an unauthenticated SQL Injection in versions

PT-2025-3712 · WordPress · Enable Accessibility

Name of the Vulnerable Software and Affected Versions: Enable Accessibility plugin for WordPress versions up to, and including, 1.4.1 Description: The issue arises from the use of add query arg and remove query arg without proper escaping on the URL, allowing unauthenticated attackers to inject...

PT-2025-1774 · WordPress · Wp Project Manager

Name of the Vulnerable Software and Affected Versions: WP Project Manager plugin versions up to and including 2.6.16 Description: The WP Project Manager plugin for WordPress is vulnerable to SQL Injection via the project id parameter of the "/wp-json/pm/v2/projects/2/task-lists" REST API endpoint...

phpMyFAQ 3.2.10 < 4.0.2 HTML Injection Vulnerability (GHSA-ww33-jppq-qfrp)

phpMyFAQ is prone to an HTML injection vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"; if...

ABB Cylon Aspect 4.00.00 (factorySaved.php) Unauthenticated XSS

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB Cylon Aspect BMS/BAS controller suffers from an unauthenticat...

CVE-2023-46637

Missing Authorization vulnerability in Saurav Sharma Generate Dummy Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Generate Dummy Posts: from n/a through 1.0.0...

PT-2025-1499 · Nofearinc · Dx Delete Attached Media

Name of the Vulnerable Software and Affected Versions: nofearinc DX Delete Attached Media versions 2.0.5.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in nofearinc DX Delete Attached Media, which allows exploiting incorrectly configured access control...