PT-2025-8858

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A crash issue has been identified in the Linux kernel related to the synaptics input driver. When enabling a pass-through port, an interrupt may occur before the psmouse driver binds to...

CVE-2024-56144 Stored XSS-LibreNMS-Display Name 2 in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters Replace $DEVICEID with your specific $DEVICEID value:/device/$DEVICEID/edit - param: display. Librenms versions up to 24.11.0 allow remote attackers to inject...

CVE-2025-23198 Stored-XSS-LibreNMS-Display-Name in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters Replace $DEVICEID with your specific $DEVICEID value:/device/$DEVICEID/edit - param: display. Librenms versions up to 24.10.1 allow remote attackers to inject...

CVE-2025-23201 Reflected Cross-site Scripting on error alert in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting XSS on the parameters:/addhost - param: community. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with th...

CVE-2024-52602 Server-Side Request Forgery (SSRF) on redirects and federation in Matrix Media Repo

Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo MMR is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrad...

CVE-2024-52594 Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib

Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit c4f1e01 fixes this issue. Users are advised to upgrade. Users unable to upgrade shoul...

PT-2025-4742

Name of the Vulnerable Software and Affected Versions RE11S version 1.11 Description A stack overflow issue was discovered in the formWlSiteSurvey function through the selSSID parameter. Recommendations For RE11S version 1.11, consider disabling the formWlSiteSurvey function or restricting access...

PT-2025-3570 · Jfinaloa · Jfinaloa

Name of the Vulnerable Software and Affected Versions: JFinalOA versions prior to 2025.01.01 Description: A cross-site scripting XSS issue in the "/apply/getEditPage?view" interface allows attackers to execute arbitrary web scripts or HTML via a crafted payload. This enables the execution of...

PT-2025-2689

Name of the Vulnerable Software and Affected Versions Google Go versions prior to 1.22.10 and 1.23.4 Description The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will...

openSUSE: Security Advisory for the Linux Kernel (Live Patch 21 for SLE 15 SP4) (SUSE-SU-2025:0123-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-1617 · WordPress · The Motors – Car Dealer

Name of the Vulnerable Software and Affected Versions: The Motors – Car Dealer, Classifieds & Listing plugin for WordPress versions 1.4.43 and earlier Description: The issue allows authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes due to the software...

PT-2025-3565 · Jfinaloa · Jfinaloa

Name of the Vulnerable Software and Affected Versions: JFinalOA versions prior to 2025.01.01 Description: A cross-site scripting XSS issue in the "common/getEditPage?view" interface allows attackers to execute arbitrary web scripts or HTML via a crafted payload. This could potentially lead to the...

PT-2025-3933 · FFmpeg +5 · Ffmpeg +5

Name of the Vulnerable Software and Affected Versions: FFmpeg version 7.1 Description: The issue is an Unchecked Return Value, Out-of-bounds Read vulnerability that allows reading sensitive constants within an executable. This vulnerability is associated with program files, specifically the af...

PT-2025-4741

Name of the Vulnerable Software and Affected Versions RE11S version 1.11 Description A command injection issue was discovered via the L2TPUserName parameter at the "/goform/setWAN" API endpoint. This allows for potential command injection attacks. Recommendations For RE11S version 1.11, as a...

PT-2025-3566 · Jfinaloa · Jfinaloa

Name of the Vulnerable Software and Affected Versions: JFinalOA versions prior to 2025.01.01 Description: A cross-site scripting XSS issue in the "/bumph/getDraftListPage?type" interface allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For versions...

PT-2025-3567 · Jfinaloa · Jfinaloa

Name of the Vulnerable Software and Affected Versions: JFinalOA versions prior to 2025.01.01 Description: A cross-site scripting XSS issue in the openSelectManyUserPage?orgid interface of JFinalOA allows attackers to execute arbitrary web scripts or HTML via a crafted payload. This enables the...

PT-2025-2692

Name of the Vulnerable Software and Affected Versions Google Go versions up to 1.22.10/1.23.4 Description A certificate with a URI which has an IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not...

PT-2025-3562 · Jfinaloa · Jfinaloa

Name of the Vulnerable Software and Affected Versions: JFinalOA versions prior to v2025.01.01 Description: The issue is a SQL injection vulnerability via the component validRoleKey?sysRole.key. This vulnerability allows for the injection of malicious SQL code, potentially leading to unauthorized...

PT-2025-5097 · WordPress · Wp Options Editor

Name of the Vulnerable Software and Affected Versions: WP Options Editor versions n/a through 1.1 Description: A Cross-Site Request Forgery CSRF issue allows Privilege Escalation. This means an attacker can perform actions on behalf of another user without their knowledge or consent...

PT-2025-3568 · Jfinaloa · Jfinaloa

Name of the Vulnerable Software and Affected Versions: JFinalOA versions prior to v2025.01.01 Description: A cross-site scripting XSS vulnerability in the "getBusinessUploadListPage?busid" interface of JFinalOA allows attackers to execute arbitrary web scripts or HTML via a crafted payload...