PT-2025-43020

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions through 2.11.22 Description The Welcart e-Commerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through the order mail setting. Insufficient sanitization of the order mail...

WordPress plugin email-attachment-by-order-status-products cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-43181

Name of the Vulnerable Software and Affected Versions Cozy Vision SMS Alert Order Notifications versions through 3.8.5 Description A flaw exists in Cozy Vision SMS Alert Order Notifications that allows for SQL Injection. This issue is due to improper neutralization of special elements within SQL...

CVE-2025-49915: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through = 3.8.5...

CVE-2025-10570: Authorization Bypass Through User-Controlled Key

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the saverefundrequest function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit...

SUSE CVE-2025-40015

In the Linux kernel, the following vulnerability has been resolved: media: stm32-csi: Fix dereference before NULL check In 'stm32csistart', 'csidev-ssubdev' is dereferenced directly while assigning a value to the 'srcpad'. However the same value is being checked against NULL at a later point of...

CVE-2025-61761

Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft component: Work Order Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2025-61761

Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft component: Work Order Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

EUVD-2025-35249

Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft component: Work Order Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

GHSA-R2VG-HVJM-FG38 Shopware Customer Orders can be canceled, even if refunds are disabled

Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds in the cart panel.Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route and also not i...

Missing Authorization

Overview shopware/core is a Shopware platform is the core for all Shopware ecommerce products. Affected versions of this package are vulnerable to Missing Authorization via CancelOrderRoute. An attacker can cancel their own orders by sending a specially crafted request, even when refunds are...

EUVD-2025-35206

Shopware Customer Orders can be canceled, even if refunds are disabled...

Shopware Customer Orders can be canceled, even if refunds are disabled

Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds in the cart panel.Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route and also not i...

Missing Authorization

Overview shopware/storefront is a storefront for Shopware. Affected versions of this package are vulnerable to Missing Authorization via CancelOrderRoute. An attacker can cancel their own orders by sending a specially crafted request, even when refunds are disabled in the administration settings...

EUVD-2025-35208

Shopware vulnerable to Server-Side Request Forgery SSRF – order invoice...

PT-2025-43022

Name of the Vulnerable Software and Affected Versions Flexible Refund and Return Order for WooCommerce versions prior to 1.0.39 Description The plugin contains a missing authorization flaw within the save refund request function. This allows authenticated users with subscriber-level permissions o...

CVE-2025-61761: Improper Access Control

Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft component: Work Order Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-987546)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987546 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdmaaddrcancel happens before issuing more requests The FSM can run in a circle...

PT-2025-45765

Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds in the cart panel.Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route and also not i...

PT-2025-42982

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft versions 9.2 Description A flaw exists within the Work Order Management component of Oracle PeopleSoft Enterprise FIN Maintenance Management. A low-privileged attacker with network access via HTTP can compromise the system...