CVE-2025-64738

CVE-2025-64738 affects Zoom Workplace on macOS prior to 6.5.10. An authenticated user can trigger external control of a file name or path, enabling information disclosure via local access. The issue is tied to Zoom Workplace versions before 6.5.10; remediation is to upgrade to 6.5.10 or later per...

CVE-2025-62876

A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affects lightdm-kde-greeter. before 6.0.4...

Improper Certificate Validation

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Improper Certificate Validation via the TLS certificate verification bypass. An attacker can gain unauthorized access by exploiting improper TLS certificate verification during authentication. Remediation...

CVE-2025-12765 pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.

pgAdmin = 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification...

CVE-2025-12765

Summary of the CVE: CVE-2025-12765 affects pgAdmin4 (noted in multiple advisories) with a flaw in the LDAP authentication flow that allows bypassing TLS certificate validation. The SUSE/OpenSUSE entries and related Nessus plugins cite this CVE alongside CVE-2025-12764 and others, indicating impac...

CVE-2025-12764 pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.

pgAdmin = 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS...

CVE-2025-12763 Command injection vulnerability allowing arbitrary command execution on Windows

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input...

CVE-2025-12762 Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

pgAdmin versions up to 9.9 are affected by a Remote Code Execution RCE vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical...

EUVD-2025-163768

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Stored XSS.This issue affects Booster for WooCommerce: from n/a through = 7.3.2...

RHSA-2025:21111 Red Hat Security Advisory: bind9.18 security update

Bulletin has no description...

CVE-2025-64379 WordPress Booster for WooCommerce plugin <= 7.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster for WooCommerce: from n/a through = 7.4.0...

CVE-2025-64380

CVE-2025-64380 affects WordPress Booster for WooCommerce (woocommerce-jetpack) plugin, specifically versions up to and including 7.3.2. The root cause is improper input handling during web page generation, leading to a stored cross-site scripting (XSS) vulnerability. This means malicious script p...

CVE-2025-64370

CVE-2025-64370 affects WordPress YOP Poll plugin versions up to 6.5.38 and is described as a Missing Authorization / Broken Access Control vulnerability caused by incorrectly configured access control security levels. The CVSS v3.1 base score is 5.3 (Medium) with an Att&ck-style vector of Network...

CVE-2025-64275 WordPress Booking Manager plugin <= 2.1.17 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdevelop Booking Manager booking-manager allows Stored XSS.This issue affects Booking Manager: from n/a through = 2.1.17...

CVE-2025-12681

CVE-2025-12681 affects the WordPress plugin Comment Edit Core – Simple Comment Editing, up to version 3.1.0. The root cause is an unauthenticated exposure via the ajax_get_comment function, allowing any visitor to access sensitive data such as user IDs, IP addresses, and email addresses. Wordfenc...

CVE-2025-47220

A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLESIGNATURECUSTOMIMAGEPATH, which exists in the PDFSigner and the PAdESSigner, can be set to any path without any restrictions by an admin user. In the case that the provided path points to an...

JS-YAML 安全漏洞

JS-YAML is a JavaScript YAML parser and dump from Nodeca Open Source. A security vulnerability exists in JS-YAML version 4.1.0 and earlier, which stems from the possibility of modifying prototypes when parsing YAML documents, potentially leading to prototype contamination...

TOTOLINK A950RG 安全漏洞

TOTOLINK A950RG is an ultra-generation Giga wireless router from China's Gion Electronics TOTOLINK that supports high-speed network connectivity and multi-device management. The TOTOLINK A950RG suffers from a buffer overflow vulnerability that stems from a failure to properly validate the length...

PT-2025-46894

ZenTao Biz 6.5, ZenTao Max 3.0, ZenTao Open Source Edition 16.5, and ZenTao Open Source Edition 16.5.beta1 contain an SQL injection vulnerability in the login functionality. The application does not properly validate the account parameter on /zentao/user-login.html before using it in a database...

HP Integrated Lights-Out Improper Neutralization of Input During Web Page Generation (CVE-2021-29204)

"A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4 %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504406; scriptversion"1.1"; scriptsetattributeattribute:"pluginmodificationdate", value:"2025/11/13"; scriptcveid"CVE-2021-29204";...