PT-2025-17950 · WordPress · Integração Entre Eduzz E Woocommerce

Name of the Vulnerable Software and Affected Versions: Integração entre Eduzz e Woocommerce plugin for WordPress versions up to, and including, 1.7.5 Description: The issue is related to a missing capability check on the wep opcoes function, allowing authenticated attackers with Subscriber-level...

PT-2025-17962

Name of the Vulnerable Software and Affected Versions Formidable versions 2.1.0 through 3.x before 3.5.3 Description The issue relies on hexoid to prevent guessing of filenames for untrusted executable content. However, hexoid is documented as not cryptographically secure. There is a scenario in...

Debian dla-4138 : distro-info-data - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4138 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4138-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-3785

A vulnerability has been found in D-Link DWR-M961 1.1.36 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formStaticDHCP of the component Authorization Interface. The manipulation of the argument Hostname leads to stack-based buffer overflow. The attack can ...

WordPress Easy Guide plugin <= 1.0.0 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Le Ngoc Anh in WordPress Plugin Easy Guide versions = 1.0.0...

PT-2025-17922 · Jetbrains · Jetbrains Rider

Name of the Vulnerable Software and Affected Versions: JetBrains Rider versions prior to 2025.1.2 Description: The issue allows arbitrary file overwrite during a remote debug session due to a custom archive unpacker. Recommendations: For versions prior to 2025.1.2, update to version 2025.1.2 or...

PT-2025-17943 · Netscout · Netscout Ngeniusone

Name of the Vulnerable Software and Affected Versions: NETSCOUT nGeniusONE versions prior to 6.4.0 b2350 Description: The issue concerns hardcoded credentials in NETSCOUT nGeniusONE that can be obtained from JAR files. Recommendations: For versions prior to 6.4.0 b2350, update to version 6.4.0...

PT-2025-17887 · WordPress · Upsell Funnel Builder For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Upsell Funnel Builder for WooCommerce plugin for WordPress versions up to, and including, 3.0.0 Description: The issue allows unauthenticated attackers to manipulate orders by updating the product associated with any order bump and the...

PT-2025-17873 · Backdrop Cms · Flag

Name of the Vulnerable Software and Affected Versions: Backdrop CMS Flag module versions prior to 1.x-3.6.2 Description: A Cross-Site Scripting issue was discovered in the Flag module for Backdrop CMS. The module does not verify flag links before performing the flag action, or verify that the...

PT-2025-28379 · Bluetooth · Bluetooth

Name of the Vulnerable Software and Affected Versions: Bluetooth versions prior to SMR Jul-2025 Release 1 Description: The issue concerns improper privilege management in Bluetooth, allowing local attackers to enable Bluetooth. This could potentially lead to unauthorized access or control. There ...

PT-2025-17924 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03.1 Description: The issue is related to improper path validation in the loggingPreset parameter. This could potentially allow for unauthorized access or manipulation of files. Recommendations: For...

PT-2025-17879

Name of the Vulnerable Software and Affected Versions CNCF K3s versions 1.32.0-rc1 through 1.32.4-rc1+k3s1 Description A change in the Kubernetes kubelet configuration within the 1.32 branch transitioned from legacy CLI flags to the v1beta1.KubeletConfiguration structure. Due to the use of...

Debian dla-4137 : libbpf-dev - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4137 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4137-1 [email protected]...

PT-2025-17899 · Unknown · Service Finder Bookings +1

Name of the Vulnerable Software and Affected Versions: Service Finder Bookings plugin for WordPress versions up to and including 5.1 Description: The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation due to a lack of restriction on user role in the nsl registratio...

PT-2025-17882 · WordPress · Prevent Direct Access – Protect Wordpress Files

Name of the Vulnerable Software and Affected Versions: Prevent Direct Access – Protect WordPress Files plugin versions 2.8.6 through 2.8.8.2 Description: The issue allows unauthorized access and modification of data due to a misconfigured capability check on the pda lite custom permission check...

PT-2025-17925

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2025.03.1 Description JetBrains TeamCity is affected by a stored Cross-Site Scripting XSS issue on the Data Directory tab. This occurs because the application fails to properly protect the web page structur...

PT-2025-17907 · Easyvirt · Easyvirt Co2Scope +1

Name of the Vulnerable Software and Affected Versions: EasyVirt DCScope versions 8.6.4 and earlier EasyVirt CO2Scope versions 1.3.4 and earlier Description: The issue allows remote authenticated attackers to execute arbitrary SQL commands. This can be achieved via various parameters to specific A...

PT-2025-17870 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: A low-privileged user can elevate their privileges by creating new users and roles. Recommendations: For Sherpa Orchestrator version 141851, consider restricting the ability of low-privileged...

PT-2025-17895 · WordPress · Mythemeshop Wp Quiz

Name of the Vulnerable Software and Affected Versions: MyThemeShop WP Quiz versions 2.0.10 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables an attacker to inject...

PT-2025-10: Server-Side Request Forgery (SSRF) in HTML2PDF

The application performs insufficient validation of the destination address before sending an HTTP request. The vulnerability exploitation leads to the disclosure of sensitive data, denial of service, and etc. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 25.04.2025...