CVE-2025-47275

Summary: CVE-2025-47275 affects Auth0-PHP SDKs used with CookieStore across multiple Auth0 integrations (Laravel, WordPress, Symfony). Affected versions: Auth0-PHP in 8.0.0-BETA1 up to, but not including, 8.14.0. Applications using the SDK or linked Auth0 wrappers relying on it may have session c...

PT-2025-21147

Name of the Vulnerable Software and Affected Versions Zohocorp ManageEngine ADSelfService Plus versions prior to 6513 Description Authenticated users can perform SQL injection within the MFA reports. SQL injection is a technique where malicious SQL statements are inserted into entry fields for...

Medium: elfutils

Issue Overview: A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function libdwthreadtail in the library libdwalloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be...

Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jit_module_from_flatbuffer.

Summary Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jitmodulefromflatbuffer.This bulletin contains information regarding the vulnerability and its fixture...

WordPress Envolve Plugin plugin <= 1.0 - Unauthenticated Arbitrary File Upload via language_file and fonts_file vulnerability

Unauthenticated Arbitrary File Upload via languagefile and fontsfile vulnerability discovered by Foxyyy in WordPress Plugin Envolve Plugin versions = 1.0...

WordPress PGS Core plugin <= 5.8.0 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by István Márton in WordPress Plugin PGS Core versions = 5.8.0...

PT-2025-19337 · Unknown · Phpgurukul Online Dj Booking Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online DJ Booking Management System version 1.0 Description: A critical vulnerability was found in the PHPGurukul Online DJ Booking Management System. The issue affects the file /admin/user-search.php, where the manipulation of the...

WordPress SureForms plugin < 1.4.4 - Contributor+ Settings Update vulnerability

Contributor+ Settings Update vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin SureForms versions 1.4.4...

CVE-2025-4002 RefindPlusRepo RefindPlus BootLog.c GetDebugLogFile null pointer dereference

A vulnerability was found in RefindPlusRepo RefindPlus 0.14.2.AB and classified as problematic. Affected by this issue is the function GetDebugLogFile of the file Library/MemLogLib/BootLog.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The patch is...

Planet Technology Industrial Switch Flaws Risk Full Takeover – Patch Now

Immersive security researchers discovered critical vulnerabilities in Planet Technology network management and switch products, allowing full device control.…...

PT-2025-20476 · Totolink · Totolink N150Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N150RT version 3.4.0-B20190525 Description: A critical vulnerability has been found in the TOTOLINK N150RT, affecting some unknown processing of the file /boafrm/formWsc. The manipulation of the localPin argument leads to buffer...

WordPress Crossword Compiler Puzzles plugin <= 5.2 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by astra.r3verii in WordPress Plugin Crossword Compiler Puzzles versions = 5.2...

WordPress Fable Extra plugin <= 1.0.6 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by timomangcut in WordPress Plugin Fable Extra versions = 1.0.6...

CVE-2025-32969 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend,...

WordPress Download Manager plugin <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion vulnerability

Authenticated Author+ Arbitrary File Deletion vulnerability discovered by WordFence in WordPress Plugin Download Manager versions = 3.3.12...

WordPress CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin <= 2.4 - Unauthenticated Arbitrary File Read vulnerability

WordPress CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin = 2.4 - Unauthenticated Arbitrary File Read vulnerability discovered by khanhhnahk1 in WordPress Plugin CLEVER versions = 2.4...

WordPress Booster Plus for WooCommerce plugin <= 7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Booster Plus for WooCommerce versions = 7.2.4...

WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh in WordPress Plugin Arigato Autoresponder and Newsletter versions = 2.7.2.4...

Fedora: Security Advisory (FEDORA-2025-80dfa228e7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 41 : lemonldap-ng (2025-273b88cf62)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-273b88cf62 advisory. See https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-21-0-is-out/ Tenable has extracted the preceding description block directly from the Fedora...