PT-2025-15960 · Detheme · Dethemekit For Elementor

Name of the Vulnerable Software and Affected Versions: DethemeKit for Elementor versions n/d through 2.1.10 Description: The issue is related to a lack of authorization in Detheme DethemeKit for Elementor. This problem affects DethemeKit for Elementor from an unspecified start version up to versi...

PT-2025-15923 · WordPress · Embedder

Name of the Vulnerable Software and Affected Versions: Embedder plugin for WordPress versions 1.3 to 1.3.5 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the ajax set global option function. This enables...

PT-2025-15937 · Brizy · Brizy

Name of the Vulnerable Software and Affected Versions: Brizy versions n/a through 2.6.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for the injection of malicious scripts into web pages. No...

PT-2025-15980 · Silverstripe · Silverstripe Elemental

Name of the Vulnerable Software and Affected Versions: Silverstripe Elemental versions prior to 5.3.12 Description: The issue arises from the failure to cast input prior to including it in the grid field, allowing an elemental block to include an XSS payload. This payload can be executed when...

[SECURITY] [DSA 5898-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5898-1 [email protected] https://www.debian.org/security/ Andres Salomon April 09, 2025 https://www.debian.org/security/faq -...

CVE-2025-27391 Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: fro...

wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities

Impact wallabag versions prior to 2.6.11 were discovered to contain multiple Cross-Site Request Forgery CSRF vulnerabilities across several endpoints. An attacker could craft a malicious link or page that, if visited by a logged-in wallabag user, could trick the user's browser into performing...

CVE-2025-30677

Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs. This vulnerability can lead to unintended...

CVE-2025-31672 Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672 Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2017-20197

A vulnerability was found in propanetank Roommate-Bill-Tracking up to 288437f658fc9ee7d4b92a9da12557024d8bc55c. It has been declared as critical. This vulnerability affects unknown code of the file /includes/login.php. The manipulation of the argument Username leads to sql injection. The attack c...

CVE-2017-20197

CVE-2017-20197 affects propanetank Roommate-Bill-Tracking; vulnerable component is unknown code in /includes/login.php where manipulating the Username parameter leads to SQL injection. Attack can be remotely initiated. Patch name: b32bb1b940f82d38fb9310cd66ebe349e20a1d0a. Remediation: apply the p...

PT-2025-15800 · Foliopress · Foliopress Wysiwyg

Name of the Vulnerable Software and Affected Versions: Foliopress WYSIWYG versions n/a through 2.6.18 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows unauthorized actions to be performed on a user's account without their knowledge or consent. This is due to...

PT-2025-20478

Name of the Vulnerable Software and Affected Versions ASUS DriverHub versions prior to 1.0.6.0 Description The issue resides in the data source validation mechanism within ASUS DriverHub. Insufficient validation allows unauthorized sources to interact with the software's features through crafted...

PT-2025-15697

Name of the Vulnerable Software and Affected Versions: Apache ActiveMQ Artemis versions 1.5.1 through 2.39.x Description: The issue concerns the insertion of sensitive information into log files. When the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level...

PT-2025-15796 · WordPress · Ankit Singla Wordpress Spam Blocker

Name of the Vulnerable Software and Affected Versions: Ankit Singla WordPress Spam Blocker versions 2.0.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-15844 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions 23.1R1 through 23.2R2-S3 Junos OS versions 23.4 through 23.4R2-S3 Junos OS versions 24.2 through 24.2R2 Description: A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS...

PT-2025-15781 · Yumpu · Epaper Lister For Yumpu

Name of the Vulnerable Software and Affected Versions: ePaper Lister for Yumpu versions 1.4.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...

PT-2025-15707

Name of the Vulnerable Software and Affected Versions BentoML versions 1.0.0a1 through 1.4.7 Description The issue is related to an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized...

PT-2025-20479

Name of the Vulnerable Software and Affected Versions ASUS DriverHub versions prior to 1.0.6.0 Description An insufficient validation issue exists in ASUS DriverHub. This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints. The issue may allow...