PT-2025-31335 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.6 Description: An injection issue was addressed with improved validation. An app may be able to access sensitive user data. Recommendations: Update to macOS version 15.6...

PT-2025-31043 · Campcodes · Best Courier Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Courier Management System version 1.0 Description: A critical issue exists in Campcodes Courier Management System 1.0. The vulnerability is due to SQL injection, stemming from manipulation of the ID argument within the /view...

CVE-2025-54444

Samsung MagicINFO 9 Server is affected by a vulnerability that permits Unrestricted Upload of Files with Dangerous Types, enabling remote code execution. The issue affects MagicINFO 9 Server versions older than 21.1080.0, with a root cause in unsafe handling of uploaded files. The vulnerability c...

PT-2025-30191 · Tduckcloud · Tduck-Platform

Name of the Vulnerable Software and Affected Versions: TDuckCloud tduck-platform version 5.1 Description: A critical issue exists in TDuckCloud tduck-platform 5.1 related to SQL injection. The UserFormDataMapper function within the src/main/java/com/tduck/cloud/form/mapper/UserFormDataMapper.java...

WordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) Vulnerability

WordPress Universal Video Player - Addon for WPBakery Page Builder = 3.2.1 - Cross Site Scripting XSS Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Universal Video Player - Addon for WPBakery Page Builder versions = 3.2.1...

PT-2025-29793 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: designthemes Visual Art | Gallery WordPress Theme versions through 2.4 Description: The designthemes Visual Art | Gallery WordPress Theme contains a flaw due to deserialization of untrusted data, allowing for object injection. Recommendations...

PT-2025-28146 · Unknown · Campcodes Complaint Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complaint Management System version 1.0 Description: A critical issue has been identified, affecting the /admin/index.php file, where manipulation of the Username argument leads to SQL injection. This issue can be exploited remotely...

PT-2025-27584 · WordPress · Wp Front-End Login/Register

Name of the Vulnerable Software and Affected Versions: WP Front-end login and register plugin for WordPress versions up to, and including, 2.1.0 Description: The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scrip...

PT-2025-26468 · Code Projects · Simple Pizza Ordering System

Name of the Vulnerable Software and Affected Versions: code-projects Simple Pizza Ordering System version 1.0 Description: A critical issue was found in the Simple Pizza Ordering System. The problem is related to the manipulation of the ingname argument, which leads to SQL injection. This issue c...

WordPress WP Register Profile With Shortcode plugin <= 3.6.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin WP Register Profile With Shortcode versions = 3.6.3...

Ubuntu: Security Advisory (USN-7555-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-25541 · Unknown · Parking Management System

Name of the Vulnerable Software and Affected Versions: Das Parking Management System version 6.2.0 Description: A critical issue was found in the API component, specifically affecting an unknown part of the /IntraFieldVehicle/Search file. The manipulation of the Value argument leads to SQL...

TencentOS Server 4: pcs (TSSA-2025:0176)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0176 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

openSUSE Security Advisory (SUSE-SU-2025:01952-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress CubeWP Framework plugin <= 1.1.23 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin CubeWP versions = 1.1.23...

CVE-2025-49507

Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a through 1.7.1...

Debian dla-4210 : python-django-doc - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4210 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4210-1 [email protected]...

WordPress Inset Theme <= 1.18.0 is vulnerable to Local File Inclusion

Software Inset Type Theme Vulnerable versions = 1.18.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 2b36ab61c62f Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

CVE-2025-35008 Microhard Bullet-LTE and IPn4Gii AT+MMNAME Argument Injection

Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argume...

CVE-2025-35006

CVE-2025-35006 affects Microhard BulletLTE-NA2 and IPn4Gii-NA2. The issue is a post-authentication command injection in the AT+MFPORTFWD command, enabling privilege escalation. The root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command). The CVSSv3.1 score is 7.1 (AV:L/...