linux-firmware bug fix and enhancement update

An update is available for linux-firmware. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Lin...

ledmon bug fix and enhancement update

An update is available for ledmon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.5...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the getCookieContent function in UserRemember.php which unserializes data from a cookie without proper validation. Details Serialization is a process of converting an object into a sequence of bytes...

CVE-2024-13885

The WP e-Customers Beta WordPress plugin through 0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13885

The WP e-Customers Beta WordPress plugin (version 0.0.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page. This flaw could be leveraged to target high-privilege users, such ...

PT-2025-11148 · WordPress · Wp E-Customers Beta

Name of the Vulnerable Software and Affected Versions: WP e-Customers Beta WordPress plugin version 0.0.1 Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because the WP e-Customers Beta WordPress plugin does not properly sanitise and escape a parameter before...

CVE-2024-13885: Improper Neutralization of Input During Web Page Generation

The WP e-Customers Beta WordPress plugin through 0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress plugin WP e-Customers Beta 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2025-10613

Name of the Vulnerable Software and Affected Versions autogpt-platform versions prior to autogpt-platform-beta-v0.4.2 Description The issue is related to a server-side request forgery SSRF vulnerability inside the Send Web Request component. The root cause is that IPV6 addresses are not restricte...

WordPress WP e-Customers Beta plugin <= 0.0.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin WP e-Customers Beta versions = 0.0.1...

CVE-2025-25182 Stroom Authentication/Authorization Bypass when using AWS ALB

Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2 that allows authentication bypass to a Stroom system when configured with ALB and installed in a way that the...

CVE-2021-39202

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the cust...

CVE-2025-22609

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of I...

PT-2025-3105 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 21.0.0-beta Description: A cross-site scripting XSS issue in the Events/Agenda module allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter. This enables attackers t...

PT-2025-3106 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 21.0.0-beta Description: A cross-site scripting XSS vulnerability in the Product module of Dolibarr allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter. This issue...

CVE-2025-22611

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to escalate his or any other team members privileges to any role, including the owner role. He's also able t...

CVE-2025-22608

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to revoke any team invitations on a Coolify instance by only providing a predictable and incrementing ID,...

CVE-2025-24025

CVE-2025-24025 affects Coolify versions prior to 4.0.0-beta.380. The issue arises on the tags search page: when a search yields no results, the query is reflected in the error modal, resulting in a cross-site scripting (XSS) vulnerability. The root cause is the reflective handling of user input o...

CVE-2025-24025 Coolify Vulnerable to Reflected XSS on Tag Search

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, which leads to cross-site...

CVE-2025-22612 Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain text. If the server configuration of IP ...