PT-2025-43153

Name of the Vulnerable Software and Affected Versions Progress Planner versions prior to 1.8.1 Description An incorrect privilege assignment exists in Progress Planner, potentially allowing privilege escalation. Recommendations Update Progress Planner to version 1.8.1 or later...

PT-2025-43409

Name of the Vulnerable Software and Affected Versions BookLore versions 1.8.1 and prior Description BookLore is a self-hosted web app for managing book collections. Versions prior to a recent update have an authentication bypass issue in the BookMediaController. This allows unauthenticated users ...

PT-2025-43273

Name of the Vulnerable Software and Affected Versions Arevico WP Tactical Popup versions through 1.1 Description The software contains a flaw related to improper input handling during web page generation, specifically a Reflected Cross-Site Scripting XSS issue. This allows for the injection of...

PT-2025-43194

Name of the Vulnerable Software and Affected Versions CrocoBlock JetSearch versions through 3.5.10 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Reflected Cross-Site Scripting XSS condition. This allows an attacker to...

PT-2025-43211

Name of the Vulnerable Software and Affected Versions billingo Official Integration for Billingo versions through 4.2.5 Description A missing authorization flaw exists in billingo Official Integration for Billingo. This issue allows for privilege escalation. Recommendations Update billingo Offici...

PT-2025-43248

Name of the Vulnerable Software and Affected Versions appscreo Hello Followers versions through 2.5 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a Reflected Cross-Site Scripting XSS condition. This allows an attacker t...

Moodle Multiple Vulnerabilities (MSA-25-0041, MSA-25-0046)

Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

PT-2025-43330

Name of the Vulnerable Software and Affected Versions D-Link DIR-823G A1 version 1.0.2B05 Description The D-Link DIR-823G A1 device version 1.0.2B05 contains a buffer overflow in the FillMacCloneMac parameter of the /EXCU SHELL API endpoint. A crafted input to this parameter can lead to a Denial ...

PT-2025-43188

Name of the Vulnerable Software and Affected Versions Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices versions through 2.2.4.2 Description An incorrect privilege assignment exists in Wholesale Suite, potentially allowing privilege escalation. Recommendations Update to a version later...

PT-2025-43159

Name of the Vulnerable Software and Affected Versions Shiva WSAnalytics versions through 1.1.2 Description A flaw exists in Shiva WSAnalytics wsanalytics-google-analytics-and-dashboards that allows for Reflected Cross-site Scripting XSS. This occurs due to improper neutralization of input during...

PT-2025-43240

Name of the Vulnerable Software and Affected Versions supsystic Contact Form versions through 1.7.35 Description The software contains a flaw related to improper handling of user-supplied data when creating web pages, which can lead to Reflected Cross-site Scripting XSS. This allows attackers to...

PT-2025-43185

Name of the Vulnerable Software and Affected Versions CrocoBlock JetReviews versions through 3.0.0 Description A flaw exists in CrocoBlock JetReviews that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue is related to a PHP Remote...

PT-2025-43201

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Post Feed versions through 4.3.2 Description An authorization issue exists in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed. This allows exploitation of incorrectly configured access control security...

PT-2025-43249

Name of the Vulnerable Software and Affected Versions AppExperts versions through 1.4.5 Description An issue exists in the AppExperts application that allows retrieval of embedded sensitive data due to insertion of sensitive information into sent data. Recommendations Update to a version later th...

PT-2025-43259

Name of the Vulnerable Software and Affected Versions VibeThemes WPLMS versions through 1.9.9.8 Description The WPLMS plugin contains a flaw related to improper input handling during web page generation, which allows for Reflected Cross-Site Scripting XSS. This means that malicious code can be...

WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Order Refund vulnerability discovered by Powpy in WordPress Plugin Flexible Refund and Return Order for WooCommerce versions = 1.0.38...

WordPress WP-Force Images Download plugin <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin WP-Force Images Download versions = 1.8...

CVE-2025-62591

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

CVE-2025-62641

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

CVE-2025-62591

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...