CVE-2025-49211

CVE-2025-49211 describes a SQL injection in Trend Micro Endpoint Encryption PolicyServer that can escalate privileges. Public details identify the flaw in the BuildEnterpriseSearchString SQL construction as the root cause and note that authentication is reportedly required but can be bypassed to ...

CVE-2025-49452 WordPress PostaPanduri <= 2.1.3 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Adrian Ladó PostaPanduri allows SQL Injection. This issue affects PostaPanduri: from n/a through 2.1.3...

CVE-2025-39479 WordPress Smart Notification Plugin <= 10.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in smartiolabs Smart Notification allows Blind SQL Injection. This issue affects Smart Notification: from n/a through 10.3...

WordPress CozyStay plugin deserialization vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A deserialization vulnerability exists in the WordPress CozyStay plugin that stems from deserializing untrustworthy data, which can be exploited by an attacker to cause code...

WordPress Abandoned Cart Pro for WooCommerce plugin file upload vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file upload vulnerability exists in the WordPress Abandoned Cart Pro for WooCommerce plugin, which stems from the lack of file type validation in the...

Adobe Acrobat Reader Out-of-Bounds Read Vulnerability (CNVD-2025-13315)

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDF. Adobe Acrobat Reader has an out-of-bounds read vulnerability that can be exploited by an attacker to obtain sensitive information...

PT-2025-25666 · Wpcrm · Wp-Crm

Name of the Vulnerable Software and Affected Versions: WPCRM - CRM for Contact form CF7 & WooCommerce versions through 3.2.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2025-25737 · Unknown · Miliaris Amigdala

Name of the Vulnerable Software and Affected Versions: Miliaris Amigdala version 2.2.6 Description: A cross-site scripting XSS issue in the e-mail manager function allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload. This could potentially lead to...

WordPress MapSVG Cross-Site Scripting Vulnerability

WordPress MapSVG is a powerful WordPress map plugin that not only supports the creation of interactive maps, but also offers a wide range of customization and integration features. A cross-site scripting vulnerability exists in WordPress MapSVG, which stems from insufficient input cleanup and...

CVE-2025-40916

The CVE-2025-40916 entry concerns Mojolicious::Plugin::CaptchaPNG (Perl) v1.05, which uses the built-in rand() for captcha text and image noise, constituting a weak random number source. This root cause is explicitly stated across multiple sources (Red Hat, NVD, CVE lists). Impact is described as...

MAL-2025-4999 Malicious code in eslint-plugin-panel-ops (npm)

Malware: Executes code on install, exfiltrates data via DNS to a suspicious domain. Contains a preinstall script and phone-home behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc1ea7508e63005e73356cfdb457f0050ebb7ae1f04cb319592c30a140c4e2f2 Any computer th...

Malicious code in raise-http-server (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec0703ba285b347d94b33a68fa9cf671e9118ede49585fc79f8716d46574e04a Any computer that has this package installed or running should be considered...

MAL-2025-4979 Malicious code in composer-bin-plugin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 036dd51bd9e780aa61c787fea9cd7fe31f583824332caae73063187ceb1056b5 Any computer that has this package installed or running should be considered...

TencentOS Server 4: NetworkManager (TSSA-2025:0067)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0067 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

The vulnerability in the drivers/thunderbolt/debugfs.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the drivers/thunderbolt/debugfs.c module of the Linux operating system is related to a memory leak. Exploiting this vulnerability could allow an attacker to cause a service failure...

RHEL 9 : firefox (RHSA-2025:9073)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:9073 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

PT-2025-25527 · Tenda · Tenda Fh1205

Name of the Vulnerable Software and Affected Versions: Tenda FH1205 version 2.0.0.7775 Description: A critical vulnerability was found in the Tenda FH1205, affecting the fromVirtualSer function of the file /goform/VirtualSer. The manipulation of the argument page leads to a stack-based buffer...

MAL-2025-4965 Malicious code in zora1abs-protoc-helper (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32798df02edd137f9c9492f0b336887efd45c7af6f15e4bac809b1e107d7b4bd Any computer that has this package installed or running should be considered...

Malicious code in zora1abs-protoc01-sdk (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e1f6f2a0db6c265885a73e2231e1e0b8b7498988fcbeb1acb543de2ff113770 Any computer that has this package installed or running should be considered...

CVE-2025-36041

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which could disclose...