PT-2025-26353 · Unknown · Ali Irani Auto Upload Images

Name of the Vulnerable Software and Affected Versions: Ali Irani Auto Upload Images versions 3.3.2 and earlier Description: The issue is a Server-Side Request Forgery SSRF vulnerability that allows Server Side Request Forgery. This means an attacker can potentially force the server to make reques...

PT-2025-26335 · Unknown · Live Sports Streamthunder

Name of the Vulnerable Software and Affected Versions: Live Sports Streamthunder versions n/a through 2.1 Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue affects the Live Sports Streamthunder software. Recommendation...

PT-2025-26427 · Unknown · Rameez Iqbal Real Estate Manager

Name of the Vulnerable Software and Affected Versions: Rameez Iqbal Real Estate Manager versions n/a through 7.3 Description: A Cross-Site Request Forgery CSRF issue allows Privilege Escalation. This is a type of attack where an attacker tricks a user into performing unintended actions on a web...

PT-2025-26359 · WordPress · Wp-Recall

Name of the Vulnerable Software and Affected Versions: WP-Recall versions prior to 16.26.14 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions prior to 16.26.14, update to...

CVE-2025-6283 xataio Xata Agent route.ts GET path traversal

A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to path traversal. Upgrading to version 0.3.1 is able to address this...

Cross-site Scripting (XSS)

starcitizentools/citizen-skin is vulnerable to cross-site scripting XSS. The vulnerability is due to inadequate output encoding due to date messages returned by Language::userDate being directly inserted into raw HTML, allowing users with editinterface rights to inject arbitrary HTML...

HTML Injection

starcitizentools/citizen-skin is vulnerable to HTML injection. The vulnerability is due to unsanitized user-controlled input being directly inserted into raw HTML without proper validation or escaping, allowing an attacker to inject arbitrary HTML into the DOM and potentially perform Cross-Site...

BELL-CVE-2025-50182

Bulletin has no description...

HTML Injection

starcitizentools/citizen-skin is vulnerable to HTML Injection. The vulnerability is due to improper handling and lack of sanitization of user-editable messages that are directly rendered as HTML, allows an attacker to inject arbitrary HTML into the DOM...

PT-2025-26213 · WordPress · Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: WPBakery Page Builder for WordPress versions up to, and including, 8.4.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Grid Builder feature due to insufficient input sanitization and output escaping on...

DLA-4222-1 activemq - security update

Bulletin has no description...

ROS-20250619-15

A software vulnerability in the Grafana monitoring and surveillance platform is related to a vulnerability in the of the XY Chart plugin to DOM XSS. Exploitation of the vulnerability could allow an attacker acting remotely, execute arbitrary code Grafana monitoring and surveillance platform...

[ASA-202506-8] erlang: arbitrary file overwrite

Arch Linux Security Advisory ASA-202506-8 ========================================= Severity: Medium Date : 2025-06-19 CVE-ID : CVE-2025-4748 Package : erlang Type : arbitrary file overwrite Remote : No Link : https://security.archlinux.org/AVG-2900 Summary ======= The package erlang before versi...

PT-2025-26247 · Xataio · Xata Agent

Name of the Vulnerable Software and Affected Versions: xataio Xata Agent versions up to 0.3.0 Description: A path traversal issue has been identified, affecting the GET function of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to this issue...

WordPress Spark Multipurpose Theme <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software Spark Multipurpose Type Theme Vulnerable versions = 1.0.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-50030 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 093473ec2f16 Credits Peter Thaleikis Required privilege...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Improper Resource Shutdown or Release in Eclipse Jetty (CVE-2024-13009)

Summary Eclipse Jetty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD. CVE-2024-13009 Vulnerability Details CVEID:CVE-2024-13009 DESCRIPTION: In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. Thi...

Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates

The Couchbase .NET SDK client library before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default...

MAL-2025-5403 Malicious code in epic-ue-saleforce-form (npm)

The package communicates with a domain associated with malicious activity...

BIT-NODE-MIN-2024-3566 Command injection vulnerability in programing languages on Microsoft Windows operating system.

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied...

GHSA-CRVV-6W6H-CV34 Grafana long dashboard title or panel name causes unresponsives

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher...