openSUSE Security Advisory (SUSE-SU-2025:1126-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-31492

Summary (concrete): CVE-2025-31492 affects the mod_auth_openidc Apache module (OpenID Connect Relying Party). Before version 2.4.16.11, a bug allowed disclosure of protected content to unauthenticated users when OIDCProviderAuthRequestMethod is POST, a valid account exists, and there is no applic...

CVE-2025-31492

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a modauthopenidc results in disclosure of protected content to unauthenticated users. The...

CVE-2025-31488

Plain Craft Launcher (PCL) is affected. When a homepage uses WebBrowser controls in its WPF UI, the app loads the page via Internet Explorer in the background, allowing an attacker with a malicious homepage to access the target webpage without user awareness. The issue is fixed in version 2.9.3.

PT-2025-18033 · Totolink · Totolink N150Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N150RT version 3.4.0-B20190525 Description: A vulnerability was found in the MAC Filtering Page component of the TOTOLINK N150RT router, affecting some unknown functionality of the file /home.htm. The manipulation of the Comment...

PT-2025-15110 · Unknown · Codeprojects Online Restaurant Management System

Name of the Vulnerable Software and Affected Versions: codeprojects Online Restaurant Management System version 1.0 Description: A critical vulnerability has been found in the codeprojects Online Restaurant Management System. The issue affects an unknown functionality of the file /admin/combo...

PT-2025-15109 · Unknown · Codeprojects Online Restaurant Management System

Name of the Vulnerable Software and Affected Versions: codeprojects Online Restaurant Management System version 1.0 Description: A critical vulnerability was found in the codeprojects Online Restaurant Management System. The vulnerability affects an unknown functionality of the file /admin/user...

RHEL 7 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 7.4.21 (RHSA-2025:3465)

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3465 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This...

PT-2025-18654 · Totolink · Totolink Cp900L

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP900 version 6.3c.1144 B20190715 Description: The issue is related to a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This allows attackers to execute arbitrary commands via a crafted...

The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server

Impact If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the...

WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms versions = 1.1.3...

WordPress EventON plugin <= 2.4.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ngô Thiên An ancorn from VNPT-VCI in WordPress Plugin EventON versions = 2.4.1...

SUSE-SU-2025:1141-1 Security update for go1.23

This update for go1.23 fixes the following issues: - Update to go1.23.8 - CVE-2025-22871: Fix an issue with request smuggling through invalid chunked data. bsc1240550...

SUSE CVE-2025-31115

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on t...

PT-2025-14819 · Unknown · Phpgurukul E-Diary Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul e-Diary Management System version 1.0 Description: A critical issue affects an unknown functionality of the /login.php file. The manipulation of the logindetail argument leads to SQL injection. This issue can be exploited remotely...

PT-2025-14988 · Unknown · Dimitri Grassi Salon Booking System

Name of the Vulnerable Software and Affected Versions: Dimitri Grassi Salon booking system versions n/a through 10.10.7 Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation due to incorrectly configured access control security levels...

PT-2025-14930 · Unknown · Stylemix Masterstudy Lms

Name of the Vulnerable Software and Affected Versions: Stylemix MasterStudy LMS versions 3.5.23 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File...

FreeBSD : MongoDB -- crash due to improper validation of explain command (350b3389-107f-11f0-8195-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 350b3389-107f-11f0-8195-b42e991fc52e advisory. [email protected] reports: When run on commands with certain arguments set, explain may fail to validate...

PT-2025-14936 · Php +1 · Php +1

Name of the Vulnerable Software and Affected Versions: Rameez Iqbal Real Estate Manager versions n/a through 7.3 Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion', which allows PHP Local File...

PT-2025-14933 · WordPress · Coothemes Easy Wp Optimizer

Name of the Vulnerable Software and Affected Versions: coothemes Easy WP Optimizer versions 1.1.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versio...