PT-2025-15811 · Ip2Location · Ip2Location Ip2Location World Clock

Name of the Vulnerable Software and Affected Versions: ip2location IP2Location World Clock versions 1.1.9 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker could potentially trick a user into performing...

PT-2025-15797 · Chat2 · Chat2

Name of the Vulnerable Software and Affected Versions: Chat2 versions prior to 3.6.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 3.6.3, update to...

PT-2025-15703 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN versions prior to 9.13.4 Description: The issue allows manipulation of a URL for the ImageHandler to render text from a querystring parameter. This text would be displayed in the resulting image, potentially deceiving users who trust the...

PT-2025-15680 · Unknown · Ac-Wps-11Ac Series

Name of the Vulnerable Software and Affected Versions: Wi-Fi AP UNIT 'AC-WPS-11ac series' affected versions not specified Description: The issue is related to improper restriction of rendered UI layers or frames. If a user views and clicks on content on a malicious page while logged in, unintende...

PT-2025-18397

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the fixed version Description A null pointer dereference issue has been identified in the Linux kernel. The problem occurs when the CIFS module is unloaded while a TCP socket is still alive, causing a discrepancy...

PT-2025-15739 · Unknown · Woo Product Feed For Marketing Channels

Name of the Vulnerable Software and Affected Versions: Woo Product Feed For Marketing Channels versions 1.9.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

PT-2025-15815 · Unknown · Nepali Date Utilities

Name of the Vulnerable Software and Affected Versions: Nepali Date Utilities versions 1.0.13 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web applicatio...

PT-2025-15696 · Ibm · Ibm Security Guardium

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium versions 11.4 through 12.1 Description: The issue allows a privileged user to read any file on the system due to incorrect privilege assignment. Recommendations: For versions 11.4 through 12.1, update to a version that...

PT-2025-15762 · Microsoft · Windows Live Writer

Name of the Vulnerable Software and Affected Versions: Windows Live Writer versions 0.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-15673 · WordPress · Wp Multitasking

Name of the Vulnerable Software and Affected Versions: WP MultiTasking WordPress plugin versions 0.1.12 and earlier Description: The WP MultiTasking WordPress plugin does not have a CSRF check when updating its permalink suffix settings, which could allow attackers to make logged-in administrator...

SonicWall NetExtender Windows Client Multiple Vulnerabilities

1 CVE-2025-23008 - SonicWall NetExtender Improper Privilege Management VulnerabilityAn improper privilege management vulnerability in the SonicWall NetExtender Windows 32 and 64 bit client allows a low privileged attacker to modify configurations. CVSS Score: 7.2 CVSS Vector:...

[SECURITY] [DSA 5897-1] lemonldap-ng security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5897-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 08, 2025 https://www.debian.org/security/faq -...

SQL Injection

Overview shopware/core is a Shopware platform is the core for all Shopware ecommerce products. Affected versions of this package are vulnerable to SQL Injection through the aggregations object. An attacker can manipulate the SQL queries and potentially access or alter data by injecting malicious...

Shopware Vulnerable to Blind SQL-injection in DAL aggregations

Impact The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this...

CVE-2025-30150 Shopware 6 allows attackers to check for registered accounts through the store-api

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates...

April 8, 2025—KB5055561 (Monthly Rollup)

None None...

PT-2025-15317 · WordPress · Streamit

Name of the Vulnerable Software and Affected Versions: Streamit theme for WordPress versions up to, and including, 4.0.1 Description: The issue is related to arbitrary file uploads due to missing file type validation in the st Authentication Controller::edit profile function. This allows...

PT-2025-15914 · Sonicwall · Sonicwall Netextender Windows

Name of the Vulnerable Software and Affected Versions: SonicWall NetExtender versions 10.3.1 and earlier Description: An Improper Link Resolution Before File Access 'Link Following' vulnerability in SonicWall NetExtender Windows 32 and 64 bit client allows an attacker to manipulate file paths. Th...

PT-2025-15472

Name of the Vulnerable Software and Affected Versions: AOS-10 GW versions prior to 10.7.1.0 AOS-8 Controller/Mobility Conductor versions prior to 8.10.0.15 and 8.12.0.3 Description: A vulnerability in the Captive Portal could allow a remote attacker to conduct a reflected cross-site scripting XSS...

PT-2025-15344

Name of the Vulnerable Software and Affected Versions: secfr trustlet versions prior to SMR Apr-2025 Release 1 Description: The issue allows local privileged attackers to cause memory corruption due to an out-of-bounds write in the secfr trustlet. Recommendations: For versions prior to SMR Apr-20...