PT-2025-15777 · Unknown · Oleglark Vkontakte Cross-Post

Name of the Vulnerable Software and Affected Versions: oleglark VKontakte Cross-Post versions 0.3.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

SonicWall NetExtender Windows Client Multiple Vulnerabilities

1 CVE-2025-23008 - SonicWall NetExtender Improper Privilege Management VulnerabilityAn improper privilege management vulnerability in the SonicWall NetExtender Windows 32 and 64 bit client allows a low privileged attacker to modify configurations. CVSS Score: 7.2 CVSS Vector:...

[SECURITY] [DSA 5897-1] lemonldap-ng security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5897-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 08, 2025 https://www.debian.org/security/faq -...

SQL Injection

Overview shopware/core is a Shopware platform is the core for all Shopware ecommerce products. Affected versions of this package are vulnerable to SQL Injection through the aggregations object. An attacker can manipulate the SQL queries and potentially access or alter data by injecting malicious...

Shopware Vulnerable to Blind SQL-injection in DAL aggregations

Impact The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this...

CVE-2025-30150 Shopware 6 allows attackers to check for registered accounts through the store-api

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates...

April 8, 2025—KB5055561 (Monthly Rollup)

None None...

PT-2025-15914 · Sonicwall · Sonicwall Netextender Windows

Name of the Vulnerable Software and Affected Versions: SonicWall NetExtender versions 10.3.1 and earlier Description: An Improper Link Resolution Before File Access 'Link Following' vulnerability in SonicWall NetExtender Windows 32 and 64 bit client allows an attacker to manipulate file paths. Th...

PT-2025-15626 · Adobe · Framemaker

Name of the Vulnerable Software and Affected Versions: Adobe Framemaker versions 2020.8 and earlier Adobe Framemaker version 2022.6 Description: The issue is a Stack-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. To exploit this problem, th...

PT-2025-15345

Name of the Vulnerable Software and Affected Versions: libsavsac.so versions prior to SMR Apr-2025 Release 1 Description: The issue is related to an out-of-bounds read in parsing audio data, which allows local attackers to read out-of-bounds memory. This can be exploited by local attackers...

PT-2025-15635 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions prior to 9.13.2 Description: The issue allows uploading files with malicious content by renaming them to have an allowed file extension, such as renaming an executable file to have a .jpg extension. This could...

PT-2025-15501 · Microsoft · Windows Kernel +1

Name of the Vulnerable Software and Affected Versions: Windows Kernel affected versions not specified Description: The issue concerns sensitive data storage in improperly locked memory, allowing an authorized attacker to elevate privileges locally. This elevation-of-privilege vulnerability can be...

PT-2025-15576 · Microsoft · Office

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Description: The issue is related to a 'type confusion' error in Microsoft Office, allowing an unauthorized attacker to execute code locally. This can enable remote attackers to execute arbitra...

PT-2025-15416 · WordPress · Motors – Car Dealership & Classified Listings Plugin

Name of the Vulnerable Software and Affected Versions: Motors – Car Dealership & Classified Listings Plugin versions up to, and including, 1.4.66 Description: The issue allows authenticated attackers with Subscriber-level access and above to execute several initial set-up actions due to a missing...

PT-2025-15623 · Adobe · Framemaker

Name of the Vulnerable Software and Affected Versions: Adobe Framemaker versions 2020.8, 2022.6 and earlier Description: The issue is a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction...

PT-2025-15406 · Siemens · Siemens License Server

Name of the Vulnerable Software and Affected Versions: Siemens License Server SLS versions prior to V4.3 Description: A vulnerability has been identified where the affected application searches for executable files in the application folder without proper validation. This could allow an attacker ...

PT-2025-15337 · Unknown · Clipboardservice

Name of the Vulnerable Software and Affected Versions: ClipboardService versions prior to 1 Description: The issue is related to the improper handling of insufficient permission or privileges in ClipboardService. This allows local attackers to access files with system privilege. User interaction ...

PT-2025-15472

Name of the Vulnerable Software and Affected Versions: AOS-10 GW versions prior to 10.7.1.0 AOS-8 Controller/Mobility Conductor versions prior to 8.10.0.15 and 8.12.0.3 Description: A vulnerability in the Captive Portal could allow a remote attacker to conduct a reflected cross-site scripting XSS...

PT-2025-15366 · Sap · Sap Kmc Wpc

Name of the Vulnerable Software and Affected Versions: SAP KMC WPC affected versions not specified Description: The issue allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query, potentially exposing sensitive information and causing low impact on the...

PT-2025-15454 · Matrix · Element Web

Name of the Vulnerable Software and Affected Versions: Element Web versions 1.11.16 through 1.11.96 Description: The issue concerns Element Web, a Matrix web client, where versions from 1.11.16 to 1.11.96 can be configured to load Element Call from an external URL. Under certain conditions, this...