PT-2025-12809

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.91.0 and prior to 15.52.0 Description Frappe is a full-stack web application framework. A system user could create specific documents in a manner that allows for remote code execution. Recommendations Frappe version...

PT-2025-12756 · WordPress · Aoa-Downloadable

Name of the Vulnerable Software and Affected Versions: aoa-downloadable WordPress plugin version 0.1.0 Description: The issue concerns the aoa-downloadable WordPress plugin, which fails to validate a parameter in its download function. This allows unauthenticated attackers to download arbitrary...

PT-2025-12747 · Pirateforms · Contact Form & Smtp Plugin

Name of the Vulnerable Software and Affected Versions: The Contact Form & SMTP Plugin for WordPress by PirateForms versions prior to 2.6.0 Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, ...

PT-2025-12806 · Glpi +1 · Glpi Inventory Plugin +1

Name of the Vulnerable Software and Affected Versions: GLPI Inventory Plugin versions prior to 1.5.0 Description: The GLPI Inventory Plugin handles various tasks for GLPI agents, including network discovery and inventory, software deployment, and data collection. It has an improper access control...

PT-2025-12740 · WordPress · Stylish Price List

Name of the Vulnerable Software and Affected Versions: The Stylish Price List WordPress plugin versions prior to 7.1.12 Description: The issue allows high privilege users, such as contributors, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed,...

PT-2025-12743 · WordPress · The Slider By 10Web

Name of the Vulnerable Software and Affected Versions: The Slider by 10Web WordPress plugin versions prior to 1.2.62 Description: The issue concerns the Slider by 10Web WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high privilege users, such ...

PT-2025-12810

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.89.0 Frappe versions prior to 15.51.0 Description The issue allows for information disclosure through crafted requests, potentially leading to account takeover. Recommendations For versions prior to 14.89.0, update ...

PT-2025-12801

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X versions 240126 and 240802 Description A command injection issue exists due to insufficient data sanitization at the control level. An authorized attacker can execute arbitrary commands on remote devices by sending a POST reque...

Ubuntu: Security Advisory (USN-7348-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4090-1] ruby-rack security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4090-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk March 24, 2025 https://wiki.debian.org/LTS -...

GHSA-FC83-9JWQ-GC2M Web Push Denial of Service via malicious Web Push endpoint

Prior to version 0.10.3, the built-in clients of the web-push crate eagerly allocated memory based on the Content-Length header returned by the Web Push endpoint. Malicious Web Push endpoints could return a large Content-Length without ever having to send as much data, leading to denial of servic...

PT-2025-12668

Name of the Vulnerable Software and Affected Versions Kentico Xperience versions through 13.0.172 Description An authentication bypass issue exists in Kentico Xperience. This flaw is due to improper handling of empty SHA1 usernames in digest authentication within the Staging Sync Server password...

PT-2025-12708 · Onos · Onos

Name of the Vulnerable Software and Affected Versions: onos version 2.7.0 Description: The issue is related to limited secret space in LLDP packets, which can be exploited by attackers to obtain the private key via a brute force attack. Attackers can leverage this to create crafted LLDP packets...

PT-2025-12704 · Yonyou · Yonyou Ufida Erp-Nc

Name of the Vulnerable Software and Affected Versions: Yonyou UFIDA ERP-NC version 5.0 Description: A problematic issue was found in the software, affecting an unknown function of the file /help/systop.jsp. The manipulation of the langcode argument leads to cross-site scripting. It is possible to...

PT-2025-12693 · H3C · H3C Magic Be18000 +4

Name of the Vulnerable Software and Affected Versions: H3C Magic NX15 versions up to V100R014 H3C Magic NX30 Pro versions up to V100R014 H3C Magic NX400 versions up to V100R014 H3C Magic R3010 versions up to V100R014 H3C Magic BE18000 versions up to V100R014 Description: A critical vulnerability...

PT-2025-12559 · WordPress · The Slider

Name of the Vulnerable Software and Affected Versions: The Slider, Gallery, and Carousel by MetaSlider WordPress plugin versions prior to 3.95.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html...

PT-2025-17281

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.23 Linux kernel versions prior to 6.13.11 Linux kernel versions prior to 6.14.2 Description A potential out-of-bounds stack read issue exists due to the iteration code in nvmet ctrl state show accessing the...

PT-2025-12688 · H3C · H3C Magic Be18000 +4

Name of the Vulnerable Software and Affected Versions: H3C Magic NX15 versions up to V100R014 H3C Magic NX30 Pro versions up to V100R014 H3C Magic NX400 versions up to V100R014 H3C Magic R3010 versions up to V100R014 H3C Magic BE18000 versions up to V100R014 Description: A critical vulnerability...

CVE-2025-27553 Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

PT-2025-12521 · Unknown · Phpgurukul Doctor Appointment Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Doctor Appointment Management System version 1.0 Description: A critical issue affects the processing of the file /doctor/appointment-bwdates-reports-details.php in PHPGurukul Doctor Appointment Management System. The manipulation ...