GHSA-3Q2W-42MV-CPH4 filebrowser Allows Shell Commands to Spawn Other Commands

!NOTE This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities. We're publishing this new...

filebrowser allows Stored Cross-Site Scripting through the Markdown preview function

Summary The Markdown preview function of File Browser v2.32.0 is vulnerable to Stored Cross-Site-Scripting XSS. Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser Impact A user can upload a malicious Markdown file to the application which can...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to Camel-core (CVE-2020-11971)

Summary Rebind Flaw vulnerability in Camel-core may affect IBM Spectrum Control. CVE-2020-11971. Vulnerability Details CVEID:CVE-2020-11971 DESCRIPTION: Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrad...

PT-2025-27220 · Unknown · Beauty Contact Popup Form

Name of the Vulnerable Software and Affected Versions: Dilip kumar Beauty Contact Popup Form versions n/a through 6.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in the Beauty Contact...

PT-2025-27121 · Unknown · Pebas Couponxxl Custom Post Types

Name of the Vulnerable Software and Affected Versions: pebas CouponXxL Custom Post Types versions 3.0 and earlier Description: The issue is related to an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation in pebas CouponXxL Custom Post Types. Recommendations: For versio...

PT-2025-27126 · Designthemes · Designthemes Lms

Name of the Vulnerable Software and Affected Versions: designthemes LMS versions n/a through 9.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inject...

PT-2025-27153 · Cookiebot · Cookiebot

Name of the Vulnerable Software and Affected Versions: Cookiebot versions through 4.5.8 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker tricks a user...

PT-2025-27156 · Cyberchimps · Cyberchimps Responsive Blocks

Name of the Vulnerable Software and Affected Versions: CyberChimps Responsive Blocks versions n/a through 2.0.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an...

PT-2025-27229 · Raspap · Raspap

Name of the Vulnerable Software and Affected Versions: RaspAP raspap-webgui version 3.3.1 Description: The issue allows an authenticated attacker to perform a Directory Traversal attack. This is achieved by sending a crafted POST request to the "ajax/networking/get wgkey.php" endpoint with a path...

PT-2025-27227 · Unknown · Devnex Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Devnex Addons For Elementor versions 1.0.9 and earlier Description: The issue is related to Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability, which allows PHP...

PT-2025-27193 · Unknown · Plationline Payments

Name of the Vulnerable Software and Affected Versions: PlatiOnline Payments versions through 6.3.2 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions through 6.3.2...

PT-2025-27130 · WordPress · Davenport

Name of the Vulnerable Software and Affected Versions: Davenport - Versatile Blog and Magazine WordPress Theme versions 1.3 and earlier Description: The issue is a Path Traversal vulnerability that allows PHP Local File Inclusion. This vulnerability enables an attacker to access and include local...

PT-2025-27175 · Unknown · Import External Attachments

Name of the Vulnerable Software and Affected Versions: ryanpcmcquen Import external attachments versions 1.5.12 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that affects the Import external attachments feature, allowing unauthorized requests to be made on...

PT-2025-27069 · WordPress · Fl3R Accessibility Suite

Name of the Vulnerable Software and Affected Versions: FL3R Accessibility Suite plugin for WordPress versions up to, and including, 1.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode due to insufficient input sanitization and...

PT-2025-27142 · Diyhi Bbs · Diyhi Bbs

Name of the Vulnerable Software and Affected Versions: diyhi bbs versions up to 6.8 Description: A critical issue has been discovered that affects the getUrl function of the /admin/login file in the HTTP Header Handler component. The manipulation of the Host argument leads to server-side request...

PT-2025-27192 · Unknown · Quick Favicon

Name of the Vulnerable Software and Affected Versions: Quick Favicon versions through 0.22.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This enables an attacker to inject malicious...

PT-2025-27210 · Onionbuzz · Onionbuzz

Name of the Vulnerable Software and Affected Versions: OnionBuzz versions n/a through 1.0.7 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Looks Awesome OnionBuzz. Recommendations: For OnionBuzz versions n/a through 1.0.7, update to a version...

PT-2025-27279 · Mescius · Activereports.Net

Name of the Vulnerable Software and Affected Versions: Mescius ActiveReports.NET affected versions not specified Description: The issue concerns a deserialization of untrusted data remote code execution vulnerability in the TypeResolutionService. This allows for remote code execution. The estimat...

PT-2025-27231 · Ibm · Ibm Cloud Pak System

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak System versions 2.3.3.6 through 2.3.5.0 Description: A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. This issu...

PT-2025-27163 · Yaycommerce · Yaysmtp

Name of the Vulnerable Software and Affected Versions: YayCommerce YaySMTP versions n/a through 6.8.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...