GHSA-G98G-R7GF-2R25 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK

Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions: 1. Applications...

CVE-2024-24780

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes...

GHSA-J3V9-6GC7-VF5F Meteor Affected By Inefficient Regular Expression Complexity

A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/livedataserver.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be...

PT-2025-21691 · WordPress · Lambertgroup Countdown Pro Wp Plugin

Name of the Vulnerable Software and Affected Versions: LambertGroup CountDown Pro WP Plugin versions n/a through 2.7 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-21680 · WordPress · Css3 Accordions

Name of the Vulnerable Software and Affected Versions: CSS3 Accordions for WordPress versions 3.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-21752 · Sourcecodester · Stock Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester/oretnom23 Stock Management System version 1.0 Description: A critical issue has been found in the Stock Management System, affecting some unknown functionality of the file /admin/?page=back order/view bo. The manipulation of th...

PT-2025-21713 · Unknown · Lambertgroup Video Player & Fullscreen Video Background

Name of the Vulnerable Software and Affected Versions: LambertGroup Video Player & FullScreen Video Background versions 2.4.1 and earlier Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection. This allows for Blind...

PT-2025-21705 · Unknown · Scripteo Ads Pro Plugin

Name of the Vulnerable Software and Affected Versions: scripteo Ads Pro Plugin versions n/a through 4.88 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS in the scripteo Ads Pro Plugin...

PT-2025-21721 · Unknown · Validatecertify

Name of the Vulnerable Software and Affected Versions: ValidateCertify versions 1.6.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...

PT-2025-21725 · Unknown · Mapsvg Lite

Name of the Vulnerable Software and Affected Versions: MapSVG Lite versions n/a through 8.6.4 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which affects MapSVG Lite. This allows for Code Injection. Recommendations: For versions n/...

PT-2025-21724 · WordPress · Rs Wp Book Showcase

Name of the Vulnerable Software and Affected Versions: RS WP Book Showcase versions through 6.7.41 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which affects RS WP Book Showcase, allowing code injection. Recommendations: For...

PT-2025-21600 · Xu Yijie · Grpo-Flat

Name of the Vulnerable Software and Affected Versions: XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856 Description: A vulnerability has been found in the function main of the file grpo vanilla.py. The manipulation leads to deserialization. Local access is required to approach th...

PT-2025-21631 · Unknown · Production Ssm +1

Name of the Vulnerable Software and Affected Versions: feng ha ha/megagao ssm-erp version 1.0 production ssm version 1.0 Description: A critical vulnerability has been found in the affected software, affecting the uploadPicture function of the PictureServiceImpl.java file. The manipulation of the...

PT-2025-21739 · Unknown · Freefloat Ftp Server

Name of the Vulnerable Software and Affected Versions: FreeFloat FTP Server version 1.0 Description: A critical issue was found in the DELETE Command Handler component, which can be exploited remotely. The manipulation leads to a buffer overflow. The issue has been publicly disclosed and may be...

PT-2025-21763 · Gnu +1 · Gnu Pspp +1

Name of the Vulnerable Software and Affected Versions: GNU PSPP versions through 2.0.1 Description: libpspp-core.a in GNU PSPP through 2.0.1 contains an incorrect call from the fill buffer function in data/encrypted-file.c to the Gnulib rijndaelDecrypt function, resulting in a heap-based buffer...

PT-2025-21611 · Hitachi · Hitachi Ops Center Analyzer +1

Name of the Vulnerable Software and Affected Versions: Hitachi Infrastructure Analytics Advisor versions 10.0.0-00 through 11.0.4-00 Hitachi Ops Center Analyzer versions 10.0.0-00 through 11.0.4-00 Description: The issue is related to a Bypass Connection Restriction vulnerability in the Data Cent...

PT-2025-21658

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop versions prior to 3.15 Description: The issue affects Nextcloud Desktop, allowing 3rd party applications to create link shares for almost all data via the socket API. These shares can then be sent to an external service...

PT-2025-21690 · Themovation · Themovation Quickcal

Name of the Vulnerable Software and Affected Versions: Themovation QuickCal versions 1.0.0 through 1.0.15 Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For Themovation...

PT-2025-21758 · Unknown · Phpgurukul Park Ticketing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Park Ticketing Management System version 2.0 Description: A critical issue affects the processing of the file /add-normal-ticket.php, where the manipulation of the noadult argument leads to SQL injection. The attack can be initiate...

PT-2025-21760 · WordPress · Wholesale Market For Woocommerce +1

Name of the Vulnerable Software and Affected Versions: Wholesale Market WordPress plugin versions prior to 2.2.2 Wholesale Market for WooCommerce WordPress plugin versions prior to 2.0.1 Description: The issue is related to a flawed CSRF check when updating settings, which could allow attackers t...