PT-2025-11677

Name of the Vulnerable Software and Affected Versions AHAthat Plugin versions up to, and including, 1.6 Description The issue is related to time-based SQL Injection via the id parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing...

CVE-2025-2511: Improper Neutralization of Special Elements used in an SQL Command

The AHAthat Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2025-11320

Name of the Vulnerable Software and Affected Versions: The School Management System – WPSchoolPress plugin for WordPress versions up to, and including, 2.2.16 Description: The issue is related to SQL Injection via the 'addNotify' action due to insufficient escaping on the user-supplied parameter...

PT-2025-55166

Уязвимость функции extract timestamp инструмента хранения и поиска записей аудита Linux Audit связана с ошибками разыменования указателя. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

The vulnerability of the FileUtil.extract() function in the library for creating, deploying, and executing MLeap machine learning models allows a hacker to execute arbitrary code.

The vulnerability of the FileUtil.extract function in the library responsible for creating, deploying, and executing MLeap machine learning models is related to an incorrect restriction on the path to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to...

PT-2025-10420

Name of the Vulnerable Software and Affected Versions Post SMTP plugin for WordPress versions up to and including 3.1.2 Description The issue allows authenticated attackers with Administrator-level access and above to perform generic SQL Injection via the columns parameter due to insufficient...

PT-2025-9171

Name of the Vulnerable Software and Affected Versions GenerateBlocks plugin for WordPress versions prior to 1.9.2 Description The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including the content of private, draft, and scheduled posts an...

CVE-2024-13546: Exposure of Sensitive Information to an Unauthorized Actor

The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.1 via the 'getimagedescription' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data...

Security update for tiff

This update for tiff fixes the following issues: CVE-2023-25435: Heap-buffer-overflow in extractContigSamplesShifted8bits in tiffcrop.c bsc1212607. CVE-2023-52356: Segment fault in libtiff in TIFFReadRGBATileExt leading to denial of service bsc1219213. Other bugfixes: Fixed tiff build issue on...

DEBIAN-CVE-2025-21754

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix assertion failure when splitting ordered extent after transaction abort If while we are doing a direct IO write a transaction abort happens, we mark all existing ordered extents with the BTRFSORDEREDIOERR flag done at...

PT-2025-7815

Name of the Vulnerable Software and Affected Versions Yawave plugin for WordPress versions up to, and including, 2.9.1 Description The Yawave plugin for WordPress is vulnerable to SQL Injection via the lbid parameter due to insufficient escaping on the user-supplied parameter and lack of sufficie...

PT-2025-7356

Name of the Vulnerable Software and Affected Versions LTL Freight Quotes – GlobalTranz Edition plugin for WordPress versions up to, and including, 2.3.11 Description The issue is related to SQL Injection via the 'engtz wd save dropship' AJAX endpoint due to insufficient escaping on the user...

PT-2025-7358

Name of the Vulnerable Software and Affected Versions LTL Freight Quotes – SEFL Edition plugin for WordPress versions prior to 3.2.5 Description The issue concerns SQL Injection via the dropship edit id and edit id parameters due to insufficient escaping on the user-supplied parameter and lack of...

CVE-2024-13491: Improper Neutralization of Special Elements used in an SQL Command

The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 4.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

The vulnerability in the function PLT_FileMediaServerDelegate::ExtractResourcePath() of the file PltHttpServer.cpp in the software development library Platinum UPnP SDK allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the PLTFileMediaServerDelegate::ExtractResourcePath function in the pltHttpServer.cpp file of the software development library, Platinum UPnP SDK, is related to an incorrect limitation on the path name for directories with restricted access. Exploiting this vulnerability coul...

PT-2025-7363

Name of the Vulnerable Software and Affected Versions Small Package Quotes – For Customers of FedEx plugin for WordPress versions up to, and including, 4.3.1 Description The issue concerns SQL Injection via the edit id and dropship edit id parameters due to insufficient escaping on the...

PT-2025-6579

Name of the Vulnerable Software and Affected Versions Simple Signup Form plugin for WordPress versions up to, and including, 1.6.5 Description The issue is related to SQL Injection via the id attribute of the ssf shortcode. This is due to insufficient escaping on the user-supplied parameter and...

CVE-2025-1225

A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interface. The manipulation leads to xml external entity...

CVE-2025-1225

A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interface. The manipulation leads to xml external entity...

CVE-2025-1225: Improper Restriction of XML External Entity Reference

A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interface. The manipulation leads to xml external entity...