Security Bulletin: IBM Information Server is affected by an Information Disclosure vulnerability (CVE-2025-1138)

Summary An Information Disclosure vulnerability in IBM Information Server was addressed. Vulnerability Details CVEID:CVE-2025-1138 DESCRIPTION: IBM InfoSphere Information Server could disclose sensitive information to an authenticated user that could aid in further attacks against the system...

CVE-2025-46834

Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the 2.x branch prior to commit 5e6f540d249afcaeaf76ab95517d0359fde883b0, owners of Modular Accounts can grant session keys scoped external keys to external parties and would use the...

CVE-2025-47786 Emlog vulnerable to Stored Cross-site Scripting

Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct malicious JavaScript, inducing all website users to click. In /admin/comment.php, the parameter perpagenum is not validated and is directly...

CVE-2025-47787 Emlog Pro Contains a File Upload Vulnerability

Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation...

CVE-2025-47784 Emlog vulnerable to Deserialization of Untrusted Data

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...

CVE-2025-47279

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, th...

CVE-2025-47279

CVE-2025-47279 — Undici (Node.js HTTP/1.1 client) : A memory leak can occur in webhook-like usage when an attacker runs a server with an invalid TLS certificate and forces repeated webhook calls. The issue is fixed in Undici versions 5.29.0, 6.21.2, and 7.5.0. As a workaround, avoid calling a web...

Sulu vulnerable to XXE in SVG File upload Inspector

Impact A admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References. Patches The problem has not been patched yet. Users should upgrade to patched versions once they become available...

GHSA-F6RX-HF55-4255 Sulu vulnerable to XXE in SVG File upload Inspector

Impact A admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References. Patches The problem has not been patched yet. Users should upgrade to patched versions once they become available...

CVE-2025-22462

An authentication bypass in Ivanti Neurons for ITSM on-prem only before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system...

Security Bulletin: IBM MQ for HPE NonStop Server is affected by denial of service vulnerability (CVE-2025-23225)

Summary IBM MQ for HPE NonStop Server has addressed a denial of service vulnerability CVE-2025-23225, when a message without an MQXQH header is put to an XMITQ. Vulnerability Details CVEID:CVE-2025-23225 DESCRIPTION: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user to...

WordPress TicketBAI Facturas para WooCommerce plugin <= 3.18 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by CVEhunter in WordPress Plugin TicketBAI Facturas para WooCommerce versions = 3.18...

PT-2025-21275 · WordPress · Ticketbai Facturas Para Woocommerce

Name of the Vulnerable Software and Affected Versions: TicketBAI Facturas para WooCommerce plugin for WordPress versions up to, and including, 3.18 Description: The issue concerns arbitrary file deletion due to insufficient file path validation via the 'delpdf' action. This allows unauthenticated...

PT-2025-21276 · Esignal · Esignal

Name of the Vulnerable Software and Affected Versions: eSigna versions 1.0 through 1.5 Description: The issue is related to an Insecure Direct Object Reference IDOR vulnerability in the eSignaViewer component. This vulnerability allows an unauthenticated attacker to access arbitrary files in the...

PT-2025-21346 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue has been found, affecting some unknown functionality of the file /pages/transaction.php. The manipulation of the cid argument leads to SQL injection. The attack ma...

PT-2025-21344 · Unknown · Rustaurius Front End Users

Name of the Vulnerable Software and Affected Versions: Rustaurius Front End Users versions 3.2.32 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions...

PT-2025-21582 · Unknown · Itsourcecode Placement Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Placement Management System version 1.0 Description: A critical issue has been discovered, affecting the /view student.php file, where manipulation of the ID argument leads to SQL injection. This can be initiated remotely...

PT-2025-21291 · Unknown · Phpgurukul Vehicle Parking Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Vehicle Parking Management System version 1.13 Description: A critical issue was found in the PHPGurukul Vehicle Parking Management System. The problem is related to an unknown function of the file /admin/add-category.php, where th...

PT-2025-21272 · I O Data · I-O Data Hdl-T Series

Name of the Vulnerable Software and Affected Versions: I-O DATA HDL-T Series versions 1.21 and earlier Description: The issue is related to a lack of authentication for critical functions in the firmware. This could allow a remote unauthenticated attacker to modify the product's configuration...

PT-2025-21356 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue has been discovered, affecting the /pages/account summary.php file. The manipulation of the cid argument leads to SQL injection. This issue can be exploited...