Oracle Linux 9 : rpm-ostree (ELSA-2025-7147)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7147 advisory. 2025.5-1 - Rebase to 2025.5 Resolves: RHEL-78697 2025.4-1 - Rebase to 2025.4 Resolves: RHEL-68131 2025.3-1 - Rebase to 2025.3 Resolves: RHEL-68131 2025.2-1 -...

CVE-2025-46052

An error-based SQL Injection SQLi vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to /StockCounts.php...

CVE-2025-46578

There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Attackers can exploit these interfaces to inject commands and extract sensitive database information...

CVE-2025-46577

GoldenDB (ZTE) is affected by a SQL injection vulnerability where the application does not validate externally supplied SQL statements, enabling an attacker to execute arbitrary SQL and potentially exfiltrate data. Affected component: GoldenDB database product; root cause: lack of input validatio...

PT-2025-15919

Name of the Vulnerable Software and Affected Versions: Accredible Certificates & Open Badges plugin for WordPress versions up to, and including, 1.4.9 Description: The issue is related to time-based SQL Injection via the orderby parameter due to insufficient escaping on the user-supplied paramete...

PT-2025-12886

Name of the Vulnerable Software and Affected Versions The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress versions up to, and including, 1.6.8 Description The issue allows authenticated attackers with Contributor-level access and above t...

CVE-2024-12216

A vulnerability in the ImageClassificationDataset.fromcsv API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can...

PT-2025-12469

Name of the Vulnerable Software and Affected Versions WooCommerce Multivendor Marketplace – REST API plugin for WordPress versions up to, and including, 1.6.2 Description The issue allows authenticated attackers with Subscriber-level access and above to extract sensitive information from the...

CVE-2025-1311: Improper Neutralization of Special Elements used in an SQL Command

The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in the updatedeliverystatus function in all versions up to, and including, 1.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2025-12484

Name of the Vulnerable Software and Affected Versions Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit versions up to, and including, 3.5.1 Description The issue is related to SQL Injection via the automationId parameter due to insufficient...

PT-2025-25340

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The software suffers from an unknown read issue. The crash state involves the functions extract sess version, parse sdp session, and parse mixed content...

Unsafe Dependency Resolution

Overview kedro is a Kedro helps you build production-ready data and analytics pipelines Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the pullpackage API function. An attacker can execute arbitrary commands on the victim's machine by exploiting the...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the runtool command which exposes classes in the water.tools package via the ast parser. An attacker can shut down the server and write large files to arbitrary directories by exploiting the...

PT-2025-12187

Name of the Vulnerable Software and Affected Versions Vanna-ai version 0.6.2 Description The issue arises from insufficient protection against injecting additional SQL commands from user requests. This occurs when the generate sql function calls extract sql with the LLM response. An attacker can...

PT-2025-11677

Name of the Vulnerable Software and Affected Versions AHAthat Plugin versions up to, and including, 1.6 Description The issue is related to time-based SQL Injection via the id parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing...

CVE-2025-2511: Improper Neutralization of Special Elements used in an SQL Command

The AHAthat Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2025-11320

Name of the Vulnerable Software and Affected Versions: The School Management System – WPSchoolPress plugin for WordPress versions up to, and including, 2.2.16 Description: The issue is related to SQL Injection via the 'addNotify' action due to insufficient escaping on the user-supplied parameter...

PT-2025-55166

Уязвимость функции extract timestamp инструмента хранения и поиска записей аудита Linux Audit связана с ошибками разыменования указателя. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

The vulnerability of the FileUtil.extract() function in the library for creating, deploying, and executing MLeap machine learning models allows a hacker to execute arbitrary code.

The vulnerability of the FileUtil.extract function in the library responsible for creating, deploying, and executing MLeap machine learning models is related to an incorrect restriction on the path to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to...

PT-2025-10420

Name of the Vulnerable Software and Affected Versions Post SMTP plugin for WordPress versions up to and including 3.1.2 Description The issue allows authenticated attackers with Administrator-level access and above to perform generic SQL Injection via the columns parameter due to insufficient...