PT-2025-21371 · WordPress · Travelpayouts: All Travel Brands In One Place

Name of the Vulnerable Software and Affected Versions: The Travelpayouts: All Travel Brands in One Place WordPress plugin versions prior to 1.1.13 Description: The issue concerns a lack of CSRF check when importing settings from v1, which could allow attackers to make a logged-in admin update som...

Debian dla-4106 : jetty9 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4106 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4106-2 [email protected] https://www.debian.org/lts/security/...

Debian dla-4165 : open-vm-tools - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4165 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4165-1 [email protected] https://www.debian.org/lts/security/...

PT-2025-21532 · WordPress · Events Calendar

Name of the Vulnerable Software and Affected Versions: events-calendar WordPress plugin versions 1.0.4 and earlier Description: The issue concerns the events-calendar WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as...

PT-2025-21413 · WordPress · Sailthru Triggermail Plugin

Name of the Vulnerable Software and Affected Versions: Sailthru Triggermail plugin for WordPress versions 1.1 and earlier Description: The issue concerns the Sailthru Triggermail WordPress plugin, which does not properly sanitise and escape some of its settings. Additionally, it lacks CSRF...

PT-2025-21488

Name of the Vulnerable Software and Affected Versions: wccp-pro WordPress plugin versions prior to 15.3 Description: The issue concerns an open-redirect flaw via the referrer parameter, allowing the redirection of users to external sites. Recommendations: For versions prior to 15.3, update to...

PT-2025-21545 · WordPress · Posts Filter +4

Name of the Vulnerable Software and Affected Versions: Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin versions prior to 2.2.93 Description: The issue concerns the WordPress plugin's failure to validate and escape some of its block options before outputting the...

PT-2025-21504 · WordPress · Clicksold Idx Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: ClickSold IDX WordPress plugin versions 1.90 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and...

PT-2025-21553 · Unknown · Melapress File Monitor

Name of the Vulnerable Software and Affected Versions: Melapress File Monitor versions prior to 2.1.1 Description: The issue allows admins to perform SQL injection attacks due to a parameter not being sanitized and escaped before use in a SQL statement. Recommendations: For versions prior to 2.1....

PT-2025-21352 · Automattic · Automattic Tours

Name of the Vulnerable Software and Affected Versions: Automattic Tours versions n/a through 1.0.0 Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access to certain featur...

PT-2025-21573 · Sourcecodester · Sourcecodester Student Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Student Result Management System version 1.0 Description: A critical issue was found in the system, affecting the file academic/core/drop student.php. The manipulation of the img argument leads to path traversal. This issue can...

PT-2025-21437

Name of the Vulnerable Software and Affected Versions Advance Post Prefix WordPress plugin versions through 1.1.1 Description The Advance Post Prefix WordPress plugin does not properly sanitize and escape a parameter before displaying it, resulting in a Reflected Cross-Site Scripting issue. This...

PT-2025-21446 · WordPress · Wp Erp

Name of the Vulnerable Software and Affected Versions: The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin versions prior to 1.13.4 Description: The issue allows employees to manipulate parameters and access the data of terminated...

PT-2025-21469 · WordPress · Easy Property Listings

Name of the Vulnerable Software and Affected Versions: Easy Property Listings WordPress plugin versions prior to 3.5.4 Description: The issue concerns the Easy Property Listings WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the improper handling of gas limits in precompile executions. An attacker can manipulate the state of the blockchain by causing certain functions to execute with insufficient gas, leading to incomplete...

Security Bulletin: Improper Privilege Management vulnerability in IBM Event Streams

Summary IBM Event Streams is vulnerable to Improper Privilege Management vulnerability in Apache Kafka Clients to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments like in a SaaS. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION...

PYSEC-2025-60

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB.This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2.Users are recommended to upgrade to version...

PYSEC-2025-60

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version...

DoS (Denial of Service) Third-Party Dependency in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.9.10, 8.13.6, 8.14.6, 8.15.0, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score ...

DoS (Denial of Service) Third-Party Dependency in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.19.0, 9.4.0, and 9.6.0 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...