Fedora 43 : gi-loadouts / kf6-kcoreaddons / kf6-kguiaddons / kf6-kjobwidgets / etc (2025-0cc929ff17)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-0cc929ff17 advisory. PySide6 6.10.1 update. ---- Pyside6 6.10.1 release. ---- Rebuilt with stbimage patched for two new security bugs. Tenable has extracted the preceding...

X-SpringBoot 安全漏洞

X-SpringBoot is a lightweight Java rapid development platform for czx individual developers. A security vulnerability exists in X-SpringBoot version 6.0, which stems from the unsynchronized front-end and back-end privilege components and could lead to an elevation of privilege attack...

Oracle Linux 10 : qt6-qtsvg (ELSA-2025-22394)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-22394 advisory. - Fix CVE-2025-10728: Replace quadratic cycle check with linear recursion guard to prevent stack overflow Resolves: RHEL-119719 Tenable has extracted the...

Oracle Linux 10 : valkey (ELSA-2025-21936)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-21936 advisory. - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 - rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and...

UBUNTU-CVE-2025-12385

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick...

CVE-2025-13086

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7alpha1 through 2.7rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client...

CVE-2025-12465

A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks. The vendor was notified early about this vulnerability, but didn't respond with the details of...

Malicious code in elf-stats-cocoa-train-606-pwn2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b2f0588d3a0e33bfd993faa485a07e4cd60d4c7efb4c33ed006e9c29f20c50 The package elf-stats-cocoa-train-606-pwn2 was found to contain malicious code...

EUVD-2025-200876

Malicious code in elf-stats-lanternlit-fir-106 npm...

CVE-2022-50469

creationtimestamp| type| source ---|---|--- 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8...

EUVD-2025-200978

The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the 'handlegmailoauthredirect' function. This makes it possible for...

CVE-2025-12887 Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update

The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the 'handlegmailoauthredirect' function. This makes it possible for...

EUVD-2025-200732

MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service...

CVE-2025-13945

HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service...

WordPress ShopEngine plugin <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation vulnerability

Cross-Site Request Forgery to Wishlist Manipulation vulnerability discovered by Adrian Lukita in WordPress Plugin ShopEngine versions = 4.8.5...

Masa CMS 授权问题漏洞

Masa CMS is a digital experience platform. An authorization issue vulnerability exists in Masa CMS versions prior to 7.2.8, prior to 7.3.13, and prior to 7.4.6, which stems from host header poisoning and could lead to an account takeover via a password reset email...

PT-2025-48976

Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing directives...

Oracle Linux 9 : redis (ELSA-2025-20926)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20926 advisory. - rebase to 6.2.20 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 - rebase to 6.2.19 for CVE-2025-32023 and CVE-2025-48367 - rebase t...

RosarioSIS 6.7.2 - Cross-Site Scripting (XSS)

Exploit Title: RosarioSIS 6.7.2 - Cross-Site Scripting XSS Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://gitlab.com/francoisjacquet/rosariosis Software Link: https://gitlab.com/francoisjacquet/rosariosis Version: 6.7.2 Tested on: Windows CVE : CVE-2020-15718 Proof Of Concep...

RockyLinux 8 : redis:6 (RLSA-2025:19238)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:19238 advisory. redis: Lua library commands may lead to integer overflow and potential RCE CVE-2025-46817 Redis: Redis: Authenticated users can execute LUA scripts as a...