CVE-2025-47499 WordPress Simple Blog Stats plugin <= 20250416 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeff Starr Simple Blog Stats simple-blog-stats allows Stored XSS.This issue affects Simple Blog Stats: from n/a through = 20250416...

Restriction Bypass

@escape.tech/graphql-armor-cost-limit is vulnerable to Restriction bypass. The vulnerability is due to the default enabling of the ignoreIntrospection setting in GraphQL servers, which fails to enforce query cost restrictions when a query or fragment is named schema, allows attackers to bypass co...

AIX (IJ54059)

The version of AIX installed on the remote host is prior to APAR IJ54059. It is, therefore, affected by a vulnerability as referenced in the IJ54059 advisory. - xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. CVE-2022-49043 Note that Nessus has not tested for this...

LLMpatronous: Harnessing the Power of LLMs for Vulnerability Detection

Despite the transformative impact of Artificial Intelligence AI across various sectors, cyber security continues to rely on traditional static and dynamic analysis tools, hampered by high false positive rates and superficial code comprehension. While generative AI offers promising automation...

PT-2025-17602 · Grafana +1 · Grafana +1

Name of the Vulnerable Software and Affected Versions: Grafana versions v0alpha1 through v2alpha1 Description: A security issue in the /apis/dashboard.grafana.app/ endpoints allows authenticated users to bypass dashboard and folder permissions. The impact includes viewers being able to view all...

On Prem || FAS 2402 LTSR || FAS with intune certificate

Impacts and limitations of FAS with Intune certificate...

CVE-2025-32671

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in John Weissberg Print Science Designer print-science-designer allows Path Traversal.This issue affects Print Science Designer: from n/a through = 1.3.155...

CVE-2025-32631

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in oxygensuite Oxygen MyData for WooCommerce oxygen-mydata allows Path Traversal.This issue affects Oxygen MyData for WooCommerce: from n/a through = 1.0.64...

CVE-2025-32565

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in vertim Neon Product Designer neon-product-designer-for-woocommerce allows SQL Injection.This issue affects Neon Product Designer: from n/a through = 2.2.0...

Moodle 4.2.x < 4.2.2 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.23, 3.11.x prior to 3.11.16, 4.0.x prior to 4.0.10, 4.1.x prior to 4.1.5 or 4.2.x prior to 4.2.2. It is, therefore, affected by multiple vulnerabilities. - Insufficient limitations made it possibl...

Moodle 4.0.x < 4.0.9 XSS Risk on groups page

According to its self-reported version, the Moodle install hosted on the remote host is 3.11.x prior to 3.11.15, 4.0.x prior to 4.0.9, 4.1.x prior to 4.1.4 or 4.2.x prior to 4.2.1. It is, therefore, affected by a Cross-Site Scripting in content on the groups page. Note that the scanner has not...

Moodle 3.11.x < 3.11.15 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.22, 3.11.x prior to 3.11.15, 4.0.x prior to 4.0.9 or 4.1.x prior to 4.1.4. It is, therefore, affected by multiple vulnerabilities. - An issue in the logic used to check 0.0.0.0 against the cURL...

CVE-2025-32207 WordPress Ni WooCommerce Cost Of Goods plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods allows Stored XSS.This issue affects Ni WooCommerce Cost Of Goods: from n/a through = 3.2.8...

CVE-2025-31827

Fonto (Fonto – Custom Web Fonts Manager) on WordPress is affected by CVE-2025-31827. Affected versions: Fonto &lt;= 1.2.2. The vulnerability is described as an Authenticated (Author+) Arbitrary File Download arising from a path traversal weakness, enabling an authenticated attacker to download ar...

CVE-2025-31910

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in reputeinfosystems BookingPress bookingpress-appointment-booking allows SQL Injection.This issue affects BookingPress: from n/a through = 1.1.28...

CBL Mariner 2.0 Security Update: php (CVE-2025-1861)

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-1861 advisory. - In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when...

Splunk Enterprise 9.1.0 < 9.1.8, 9.2.0 < 9.2.5, 9.3.0 < 9.3.3 (SVD-2025-0301)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0301 advisory. - In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104,...

Amazon Linux 2 : jsoup (ALAS-2025-2813)

The version of jsoup installed on the remote host is prior to 1.16.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2813 advisory. jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be...

CVE-2025-31694

CVE-2025-31694 concerns the Drupal Two-factor Authentication (TFA) module. The issue is an Incorrect Authorization vulnerability that enables forceful browsing / access bypass on TFA-enabled logins. Affected versions are 0.0.0 through 1.10.0 . Root cause details in connected docs indicate that kn...

Overcoming the Challenges of Vulnerability Remediation

The following is a guest blog post by Zac Youtz, Co-Founder and CTO at valued Rapid7 partner, Furl. Here, Zac discusses how to effectively remediate vulnerabilities discovered by Rapid7’s InsightVM. Scaling vulnerability remediation with AI Vulnerability remediation is a crucial-yet-complex task...