OESA-2025-1735 sudo security update

Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done. Security Fixes: Sudo before 1.9.17p1, when used with a sudoers file that...

OESA-2025-1733 sudo security update

Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done. Security Fixes: Sudo before 1.9.17p1, when used with a sudoers file that...

PT-2025-29189 · Tenda · Tenda O3V2

Name of the Vulnerable Software and Affected Versions: Tenda O3V2 version 1.0.0.123880 Description: A critical issue exists in Tenda O3V2. The formWifiBasicSet function within the /goform/setWrlBasicInfo file of the httpd component is susceptible to a stack-based buffer overflow. This occurs...

PT-2025-27875 · Unknown · Mndpsingh287 Frontend File Manager

Name of the Vulnerable Software and Affected Versions: mndpsingh287 Frontend File Manager versions n/d through 23.2 Description: The issue is related to improper neutralization of script-related HTML tags in a web page, which allows code injection. This is a basic XSS vulnerability...

PT-2025-27969

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.1.128 Description: A bug in the jffs2 file system has been detected, caused by a fault injection in jffs2 prealloc raw node refs. The function jffs2 sum write sumnode does not check the return value of jffs2...

PT-2025-27851 · WordPress · Gozen Forms

Name of the Vulnerable Software and Affected Versions: GoZen Forms plugin for WordPress versions prior to 1.1.5 Description: The issue allows for SQL Injection due to insufficient escaping on the forms-id parameter of the dirGZActiveForm function and lack of sufficient preparation on the existing...

PT-2025-27849 · WordPress · Paymaster For Woocommerce

Name of the Vulnerable Software and Affected Versions: PayMaster for WooCommerce plugin for WordPress versions up to, and including, 0.4.31 Description: The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary locations originating from the...

PT-2025-27946 · Monitorr · Monitorr

Name of the Vulnerable Software and Affected Versions: Monitorr versions up to 1.7.6m Description: A vulnerability was found in Monitorr, affecting an unknown part of the file assets/config/ installation/mkdbajax.php of the component Installer. The manipulation of the datadir argument leads to...

PT-2025-27856 · WordPress · Powerfolio

Name of the Vulnerable Software and Affected Versions: PowerFolio plugin for WordPress versions prior to 3.2.1 Description: The issue is related to Stored Cross-Site Scripting via the Custom JS Attributes of the plugin's widgets due to insufficient input sanitization and output escaping. This...

PT-2025-28034

Name of the Vulnerable Software and Affected Versions Netmake ScriptCase versions prior to 9.12.006 23 Description The Production Environment extension contains a flaw in the administrator password reset mechanism. An unauthenticated remote attacker can bypass authentication and take over the...

PT-2025-27854 · WordPress · Smart Docs

Name of the Vulnerable Software and Affected Versions: Smart Docs plugin for WordPress versions up to, and including, 1.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'smartdocs search' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-27925 · Unknown · Teconcetheme Allmart

Name of the Vulnerable Software and Affected Versions: TeconceTheme Allmart versions n/a through 1.0.0 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. This means an attacker can potentially trick the server into...

PT-2025-27936 · Vaultdweller · Leyka

Name of the Vulnerable Software and Affected Versions: Leyka versions 3.31.9 and earlier Description: The issue is a Path Traversal vulnerability that allows PHP Local File Inclusion in VaultDweller Leyka. Recommendations: For Leyka versions 3.31.9 and earlier, update to a version that contains a...

PT-2025-27923 · Unknown · Fw Gallery

Name of the Vulnerable Software and Affected Versions: FW Gallery versions n/a through 8.0.0 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the use of malicious files. Recommendations: For FW Gallery versions n/a through 8.0.0, consider restricti...

PT-2025-27865 · WordPress · Easy Restaurant Menu Manager

Name of the Vulnerable Software and Affected Versions: Easy Restaurant Menu Manager plugin for WordPress versions up to and including 2.0.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the nsc eprm menu link shortcode. This...

PT-2025-27862 · WordPress · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.69 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the linkURL of the Mobile Menu...

PT-2025-27902 · Webemailprotector · Email Address Security

Name of the Vulnerable Software and Affected Versions: Email Address Security by WebEmailProtector versions n/a through 3.3.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that ...

PT-2025-27940 · Unknown · Bsecure - Your Universal Checkout

Name of the Vulnerable Software and Affected Versions: bSecure - Your Universal Checkout versions 1.7.9 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, which affects the bSecure - Your Universal Checkout software. This...

PT-2025-27914 · Unknown · Privatecontent - Mail Actions

Name of the Vulnerable Software and Affected Versions: PrivateContent - Mail Actions versions 2.3.2 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows P...

SUSE CVE-2025-38140

In the Linux kernel, the following vulnerability has been resolved: dm: limit swapping tables for devices with zone write plugs dmrevalidatezones only allowed new or previously unzoned devices to call blkrevalidatediskzones. If the device was already zoned, disk-nrzones would always equal...