Apache ActiveMQ NMS OpenWire Client Deserialization Vulnerability

Apache ActiveMQ NMS OpenWire Client is an American Apache Apache Foundation . A deserialization vulnerability exists in Apache ActiveMQ NMS OpenWire Client versions prior to 2.1.1, which arises from unsafe deserialization of serialized data received by an application from a user and can be...

PT-2025-18310 · Anc · Anc

Name of the Vulnerable Software and Affected Versions: ANC software versions 1.1.4 and earlier Description: The issue allows an authenticated attacker to bypass the old password check in the password change form via a web HMI. Recommendations: For ANC software versions 1.1.4 and earlier, update t...

BIT-GITLAB-2025-1908 Business Logic Errors in GitLab

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1...

CVE-2025-31200

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware ...

CVE-2025-23782

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Reflected XSS.This issue affects TotalContest Lite: from n/a through = 2.8.1...

CVE-2025-46242

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affects Watu Quiz: from n/a through = 3.4.3...

CVE-2025-46443

Server-Side Request Forgery SSRF vulnerability in Adam Pery Animate animate allows Server Side Request Forgery.This issue affects Animate: from n/a through = 0.5...

PT-2025-17768 · Unknown · Casey Johnson Loan Calculator

Name of the Vulnerable Software and Affected Versions: Casey Johnson Loan Calculator versions n/a through 1.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the Casey Johnson Loan Calculator. Recommendations: For Casey Johnson Loan Calculator...

PT-2025-17754 · Unknown · Popup Anything

Name of the Vulnerable Software and Affected Versions: Anything Popup versions n/a through 7.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS, where an attacker can inject maliciou...

PT-2025-17916

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A flaw was found in Moodle, specifically a remote code execution risk in the Moodle LMS Dropbox repository. This risk is only available to teachers and managers on sites with the Dropbox...

BIT-MEDIAWIKI-2025-3469 i18n XSS vulnerability in HTMLMultiSelectField when sections are used

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLMultiSelectField.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6,...

CVE-2025-23782

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Reflected XSS.This issue affects TotalContest Lite: from n/a through = 2.8.1...

CVE-2024-13177

Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A standard user could potentially create a symlink of the file “nsinstallation” to escalate the privileges of a different file on the system...

GHSA-2J87-P623-8CC2 Mattermost vulnerable to Observable Timing Discrepancy

Mattermost Plugin MSTeams versions 2.1.0 and Mattermost Server versions 10.5.x =10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack...

BIT-DRUPAL-2025-3057 Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

PT-2025-16525 · Unknown · Notfound Jetmenu

Name of the Vulnerable Software and Affected Versions: NotFound JetMenu versions n/d through 2.4.9 Description: The issue is related to a lack of authorization in NotFound JetMenu, allowing access to functionalities not properly constrained by Access Control Lists ACLs. Recommendations: For...

PT-2025-16423

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.0 through 8.0.41 MySQL Server versions 8.4.0 through 8.4.4 MySQL Server versions 9.0.0 through 9.2.0 Description The issue allows a high-privileged attacker with network access via multiple protocols to compromise MyS...

PT-2025-16518 · Unknown · Gurmehub Kargo Entegratör

Name of the Vulnerable Software and Affected Versions: Gurmehub Kargo Entegratör versions 1.1.14 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-16213 · Yonyou · Yonyou Yonbip Ma2.7

Name of the Vulnerable Software and Affected Versions: Yonyou YonBIP MA2.7 Description: A vulnerability was found in the function FileInputStream of the file /mobsm/common/userfile. The manipulation of the argument path leads to path traversal. The attack can be launched remotely. Recommendations...