CVE-2025-5895 Metabase dom.js parseDataUri redos

A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit...

AZL-63747 CVE-2024-47081 affecting package python-requests for versions less than 2.31.0-3

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be...

CVE-2025-49136

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-use...

CVE-2025-49136 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-use...

listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

Summary The env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on the host. While this may not be a problem on single-user super admin installations, on multi-user installations, this allows non-super-admin users with campaign or template...

PT-2025-24481 · Redqteam · Wishlist

Name of the Vulnerable Software and Affected Versions: redqteam Wishlist versions n/a through 2.1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2025-24558 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase version 54.10 Description: A problematic issue was found in the function parseDataUri of the file frontend/src/metabase/lib/dom.js. This issue leads to inefficient regular expression complexity and can be initiated remotely...

PT-2025-24431 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.4.4 Discourse version 3.5.0.beta5 and earlier of the beta branch Discourse version 3.5.0.beta6-dev and earlier of the tests-passed branch Description: Discourse is an open-source discussion platform. Sending a...

PT-2025-24475 · Elfsight · Elfsight Contact Form Widget

Name of the Vulnerable Software and Affected Versions: elfsight Contact Form widget versions n/a through 2.3.1 Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For versions...

PT-2025-24510 · Unknown · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global versions n/a through 2.12.4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations:...

PT-2025-24465 · Bzotheme · Bzotheme Craftxtore

Name of the Vulnerable Software and Affected Versions: BZOTheme CraftXtore versions n/a through 1.7 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-24428 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: The issue is related to an incorrect authorization vulnerability. This vulnerability allows an attacker with a low privilege level to change the password of other users through a POST request using the...

PT-2025-24483 · Unknown · Pimp - Creative Multipurpose

Name of the Vulnerable Software and Affected Versions: PIMP - Creative MultiPurpose versions 1.7 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.7 and earlier, update to a version that contains a fi...

PT-2025-24405

Name of the Vulnerable Software and Affected Versions Broadstreet WordPress plugin versions prior to 1.51.8 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. Th...

PT-2025-24485 · Unknown · Lambertgroup Sticky Radio Player

Name of the Vulnerable Software and Affected Versions: LambertGroup Sticky Radio Player versions n/a through 3.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-24521 · Unknown · Cryptocloud - Crypto Payment Gateway

Name of the Vulnerable Software and Affected Versions: CryptoCloud - Crypto Payment Gateway versions n/a through 2.1.2 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

PT-2025-24519 · Unknown · Alex Zaytseff Multi Cryptocurrency Payments

Name of the Vulnerable Software and Affected Versions: Alex Zaytseff Multi CryptoCurrency Payments versions n/a through 2.0.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injectio...

PT-2025-24562 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.0 Description: The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in...

PT-2025-24472 · Miniorange · Miniorange Password Policy Manager

Name of the Vulnerable Software and Affected Versions: miniOrange Password Policy Manager versions 2.0.4 and earlier Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel, allowing Authentication Abuse. Recommendations: For miniOrange Password Policy...

PT-2025-24402 · WordPress · The Newsletter

Name of the Vulnerable Software and Affected Versions: The Newsletter WordPress plugin versions prior to 8.8.5 Description: The issue concerns a lack of validation and escaping of certain Widget options in the plugin, which can lead to Stored Cross-Site Scripting attacks. This can be exploited by...