CVE-2025-24899

reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where an insider attacker with any role such as Auditor, Penetration Tester, or Sys Admin can extract sensitive information from other reNgine users. After running a scan and obtainin...

[SECURITY] [DSA 5857-1] openjdk-17 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5857-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 03, 2025 https://www.debian.org/security/faq -...

WordPress CM Product Recommendation Widget plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin CM Product Recommendation Widget versions = 1.1.5...

PT-2025-3458 · Sayski · Sayski Forestblog

Name of the Vulnerable Software and Affected Versions: sayski ForestBlog version 20241223 Description: The issue allows a remote attacker to escalate privileges via the article editing function. This is related to a Cross Site Scripting problem. Recommendations: For sayski ForestBlog version...

PT-2025-16244 · Pegasystems · Pega Platform

Name of the Vulnerable Software and Affected Versions: Pega Platform versions 7.2.1 through Infinity 24.2.1 Description: The issue is related to an XSS problem with Mashup in Pega Platform. Recommendations: For Pega Platform versions 7.2.1 through Infinity 24.2.1, consider disabling the Mashup...

PT-2025-5606 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: reNgine affected versions not specified Description: The issue allows a user to inject commands via the nmap cmd parameters. This is a command injection issue in the reNgine automated reconnaissance framework for web applications. Users are...

PT-2025-4624 · Unknown · Cf7 Google Sheets Connector

Name of the Vulnerable Software and Affected Versions: CF7 Google Sheets Connector versions n/a through 5.0.17 Description: The issue is related to a lack of authorization in GSheetConnector CF7 Google Sheets Connector, which allows exploiting incorrectly configured access control security levels...

CVE-2025-0970

A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /Account/Login. The manipulation of the argument ReturnUrl leads to open redirect. The attack can be launched remotely. The...

DoS (Denial of Service) com.thoughtworks.xstream:xstream Dependency in Bamboo Data Center and Server

This High severity com.thoughtworks.xstream:xstream Dependency vulnerability was introduced in versions 9.1.0, 9.2.1, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0-rc5, 10.1.0, and 10.2.0 of Bamboo Data Center and Server. This com.thoughtworks.xstream:xstream Dependency vulnerability, with a CVSS Score of 7...

PT-2025-4109 · Unknown · Itsourcecode Tailoring Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Tailoring Management System version 1.0 Description: A critical issue has been found in the itsourcecode Tailoring Management System, affecting some unknown functionality of the file expview.php. The manipulation of the expid...

PT-2025-2072 · WordPress · Fast Tube

Name of the Vulnerable Software and Affected Versions: Fast Tube WordPress plugin versions 2.3.1 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could b...

PT-2025-5582 · Acronis · Acronis Cyber Protect Cloud Agent

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Windows versions prior to build 39378 Description: The issue is related to a local privilege escalation due to a DLL hijacking vulnerability. This means that an attacker could potentially exploit this weaknes...

PT-2025-1732 · WordPress · The Post Form – Registration Form – Profile Form For User Profiles – Frontend Content Forms For User Submissions

Name of the Vulnerable Software and Affected Versions: The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress versions up to, and including, 2.8.13 Description: The issue is related to Stored Cross-Site Scripting v...

PT-2025-1973 · WordPress · Zalomení Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Zalomení WordPress plugin versions 1.5 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

PT-2025-2078

Name of the Vulnerable Software and Affected Versions SlideDeck 1 Lite Content Slider plugin versions 1.4.8 and earlier Description The issue arises from the plugin not sanitizing and escaping a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting that...

PT-2025-2074

Name of the Vulnerable Software and Affected Versions The WordPress Google Map Professional Map In Your Language WordPress plugin versions 1.0 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before...

PT-2025-2758 · Ibm · Ibm Sterling B2B Integrator

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator versions 6.0.0.0 through 6.1.2.5 IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.3 Description: The issue allows a privileged user to embed arbitrary JavaScript code in the Web UI, altering the intended...

PT-2025-2970 · Openpanel · Openpanel

Name of the Vulnerable Software and Affected Versions: OpenPanel version 0.3.4 Description: An issue in the Copy and View functions of the File Manager component allows attackers to execute a directory traversal via a crafted HTTP request. Recommendations: For OpenPanel version 0.3.4, consider...

YSA 2025 01 | Yubico

Yubico’s open source pam-u2f software package implements a Pluggable Authentication Module PAM that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue which allows for an authentication bypass in...

PT-2025-2194 · WordPress · The Shared Files – Frontend File Upload Form & Secure File Sharing

Name of the Vulnerable Software and Affected Versions: The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress versions up to, and including, 1.7.42 Description: The issue is related to Stored Cross-Site Scripting via dfxp File uploads due to insufficient input...